Microsoft says treat AI agents like insiders. What should a small team do?

What did Microsoft announce?

On 19 October 2026 Hayete Gallot, who runs Microsoft Security, published a post on the Official Microsoft Blog called "Securing the agentic insider". Its central line is blunt: "frontier models, regardless of their origin, cannot be trusted". The point is not that models are malicious. Microsoft argues that agents are built to chase results, adapt as context changes and "are frequently overprivileged", so they should be managed like insiders with access to your systems.

Alongside the post, Microsoft described new controls, reported by SiliconANGLE and TechCrunch:

• Agent discovery. Its tools can detect 60 types of agents running on employee machines, including Claude Code and Codex.
• Agent identities. Agents get their own identity through Microsoft Entra Agent ID, so their actions can be traced.
• Risk-based access. As an agent's risk score rises, it loses write access first, then needs human approval for high-impact actions, then is isolated or stopped.
• Task-scoped permissions. Temporary access for one task, capped so an agent never holds more authority than the person it works for.
• Guardian Agents. Agents that watch other agents and can recommend or apply containment.

Microsoft gave no availability dates or pricing and pointed customers to Microsoft Ignite, which opens on 17 November.

Why call an AI agent an "insider"?

Because it has the access of a colleague without the judgment of one. An agent connected to your inbox, CMS or CRM can read, write and send at speed. If it misreads an instruction, it makes the mistake with your credentials. As TechCrunch reported, Microsoft CEO Satya Nadella put it this way: "We simply can't outsource responsibility for what intelligence does on our behalf."

The same shift is visible across the big platforms. On 15 October Microsoft said Copilot Studio agents can work in Microsoft 365 "with their own credentials" and scoped permissions, rolling out through its Frontier programme. On 8 October Google introduced the Gemini agent and said Gemini can create coworker agents with their own accounts. Agents are becoming accounts on your team, so they need the rules you already apply to accounts.

Does this matter for a small team?

Yes, arguably more. A five-person startup often connects an agent with the founder's own login and full access because it is quicker. G2's 2026 AI Agents Report, based on a survey of more than 1,000 B2B software buyers, found that 66% of organisations have agents in limited or scaled production, 52% require human quality review before production, and 31% say employees spend six or more hours a week overseeing agent work. Oversight is already a real cost. Tight permissions keep it small, because a mistake in a draft is cheap and a mistake in a sent email is not.

How much access should an AI agent get?

Our advice: treat access as a ladder, and only move an agent up once it has earned it on that specific task.

Worked example: an agent that writes your blog and answers enquiries

Say you want an agent to publish a weekly article on your website and draft replies to contact-form enquiries. Here is a setup that follows Microsoft's principles without any enterprise software:

1. 1Give the agent its own account. A separate email address and a separate CMS or GitHub user, never your personal password. Every change is then labelled as the agent's.
2. 2Website: drafts only. The agent can create a draft post or a branch with a preview link. It cannot publish to the live site. A person reads the preview and clicks publish.
3. 3Inbox: one folder, no send button. Route enquiries to a shared address or label the agent can read. It writes draft replies; a person sends them.
4. 4Short-lived, narrow keys. Any API token covers only the site or label it needs and expires. No admin keys.
5. 5A log you actually read. Once a week, scan what the agent changed. If something surprises you, move it down a level.
6. 6A clear off switch. Know how to revoke its access in under a minute.

After a month of clean drafts, you might let it publish small fixes, such as broken links, without review. The first article and the first customer reply stay with a human.

What should you check this week?

1. 1List every agent or AI tool connected to your email, website, CRM or files.
2. 2Note whose login each one uses.
3. 3Remove send, publish and delete rights wherever they aren't essential.
4. 4Move agents onto their own accounts where the tool allows it.
5. 5Name one person who approves anything that goes out under your brand.

Our AI workflows service is built around scoped connections and preview before publish. If you want a website where every change goes through a preview first, see Next.js development.

Sources

• Securing the agentic insider (Microsoft, 19 October 2026)
• Microsoft targets the agentic insider with new controls for rogue AI agents (SiliconANGLE, 19 October 2026)
• Microsoft says AI agents are like insider threats as frontier models can't be trusted (TechCrunch, 19 October 2026)
• Delegate shared business processes to agents with Microsoft Copilot Studio (Microsoft, 15 October 2026)
• Gemini at Work 2026: introducing Gemini agent (Google Cloud, 8 October 2026)
• 2026 AI Agents Report (G2, 14 October 2026)