Microsoft's Agent Controls, New Chip Options and the Junior Hiring Squeeze

On the 19th of October, Microsoft announced that project perception is extending beyond defense against external attacks to monitoring and constraining agents already operating inside an organization.

Those agents may be there legitimately.

They may also have permission to make changes, which makes the distinction between observing a problem and blocking an action especially important.

Microsoft says it's adding 35 types of local agents to its discovery capabilities, bringing the total to 60.

The examples include Claude Code, Codex, and GitHub Copilot.

Agent identities and a shared registry are also part of the announcement.

For an administrator, discovering an agent and identifying it are the starting points for attaching controls to what it does.

The more interesting part is what Microsoft calls dynamic agent risk and dynamic conditional access.

These controls are intended to change permissions as risk changes.

Instead of treating access as a decision made once at the beginning, the system could preserve read access while blocking rights or require a person to approve an action.

That distinction has a concrete consequence.

Reading information and altering it are different kinds of authority.

If a task can still make progress by examining information, a restriction on rights needn't end all useful activity.

Equally, an agent that can still read hasn't been completely isolated.

The value of a graduated response depends on matching the restriction to the concern.

Microsoft's announcement brings together identity, runtime, and network controls alongside supervisory systems it calls guardian agents.

Runtime controls act while software is operating.

Network controls concern its connections.

An AI supervisor may help assess what's happening, but the enforcement outside the model is the part I'd focus on.

A supervisor's assessment and a system's ability to refuse a right are separate capabilities.

For organizations evaluating this, I judge the approach by whether a changed permission reliably constrains the next action while preserving the work that's still allowed.

That's a more useful test than how many supervisory agents have been added.

It also gets closer to the operational problem.

An administrator needs a response that is effective without turning every concern into a complete shutdown.

There are limits to what this announcement establishes.