The report
Microsoft's October 19 security announcement expands Project Perception around a central premise: an AI agent should have its own accountable identity and receive only the authority required for its current task. The company describes discovery, dynamic permissions, runtime controls and risk-based containment as connected responsibilities, rather than a single guardrail inside the model.
Microsoft reports expanding discovery to 60 categories of local agents, including coding agents. Discovery is not itself protection: the announcement separately proposes extending Entra Agent ID, assigning time-limited Dynamic Permissions, mediating tool and network access, and adapting policy as risk changes. The described containment options include preserving safe reads while blocking writes, reducing accessible resources and requiring verified human approval for higher-impact operations.
Those are different enforcement stages. A useful evaluator should ask four questions: was the correct executing agent identified, was a task-specific grant issued, did each tool or delegated subagent use only that grant, and did a prohibited operation fail at its actual side-effect boundary? A dashboard showing an agent or recording a warning does not answer the final question.
The relevance is concrete but not a claim of retrospective prevention. In Wiz's October cloud intrusion, compromised infrastructure identities were used for cloud and deployment operations. In the separate Marketplace disclosure, a connected assistant reportedly acted under standing permission when sharing a residence. The first calls for independent control over privileged infrastructure credentials; the second calls for transaction- and disclosure-scoped authorization. Neither source demonstrates that Microsoft's design was deployed in those environments.
The announcement describes product direction and named capabilities, but it does not supply a universally applicable deployment matrix or independent tests for every supported agent, operating system and connector. The useful next evidence will be reproducible denials for exact operations, including nested tools, background execution and permission changes during a running task.