Microsoft wants enterprise security systems to stop an AI agent from writing data without necessarily stopping it from safely reading. As risk rises, those systems should narrow its access, demand verified human approval, isolate its runtime, or stop execution.
That graduated response is central to Microsoft’s October 19, 2026, Project Perception extension. The update expands Microsoft’s security architecture to govern agents operating inside an organization, with Guardian Agents supervising their actions. It is not a new foundation model.
The announcement also contains a warning from Microsoft Security chief Hayete Gallot that frontier models “cannot be trusted.” In context, she is arguing for containing unpredictable software, not alleging that the models are inherently malicious.
The practical question is whether an enterprise can enforce limits when an agent stops behaving as expected.
“Cannot Be Trusted” Means Authority Must Sit Elsewhere
In her announcement explaining the security rationale, Gallot writes:
Unfortunately, frontier models, regardless of their origin, cannot be trusted.
She immediately distinguishes unpredictability from malicious intent. Models are trained to achieve results, she argues, are not optimized around an organization’s norms or judgment, and can change their behavior as their context changes.
An enterprise does not need to establish that an agent is hostile before restricting its access. A legitimate agent can encounter misleading instructions, misunderstand its task, or pursue an objective in a way its operator did not intend.
Microsoft calls these systems “agentic insiders” because they operate within the enterprise with access to its data, tools, and business processes. The phrase describes their position and potential impact. It does not establish that every deployed agent has caused an incident.
The proposed response separates the intelligence doing the work from the authority governing it. A model’s instructions may tell it not to perform an action, but an external control must decide whether that action is permitted. For security teams, the test is straightforward: can the system deny an operation even when the agent insists it is necessary?
What Project Perception Adds
Microsoft describes the extension as applying Project Perception’s security stack to agents inside the enterprise. Guardian Agents are part of that architecture, not a replacement name for the underlying model.
