Microsoft is proposing a new layer of oversight for enterprise AI agents, arguing that autonomous software acting on a company's behalf needs continuous supervision rather than occasional check-ins. The company describes these agents as potential "agentic insiders" — a term that puts them in the same risk category as employees who already have access to sensitive systems. Its answer is Project Perception, a system designed to monitor and contain what those agents do.
Why agents get the insider label
An AI agent inside a corporate network isn't a passive tool. It can read files, call APIs, send messages, and trigger workflows. That's the point of deploying one. But it also means the agent operates with a level of trust that security teams normally reserve for people. Microsoft's framing is blunt: treat the agent as an insider, because that's effectively what it is. The company says agentic AI requires continuous supervision, not the periodic audits that cover most enterprise software.
The risk isn't hypothetical in Microsoft's description. An agent given broad permissions could take actions that look legitimate in isolation but add up to something else. It could be manipulated through prompt injection, or it could simply compound small errors across a series of automated steps. Either way, the damage happens before a human reviews a log.
What Project Perception is meant to do
Project Perception is outlined as a monitoring and containment layer. The public description is thin on technical detail — Microsoft hasn't published a full architecture or a list of supported agent frameworks. What it does say is that the system watches agent behavior and restricts what an agent can do when something looks wrong. That's a different posture from traditional security software, which mostly detects bad activity after it happens. Containment implies an active brake, not just an alert.
The project fits into a broader push across the enterprise software industry to make AI agents auditable. Companies are already deploying agents for customer support, internal search, and software development, often with limited visibility into what those agents touch. Microsoft's argument is that the visibility has to come first, or at least alongside the deployment.
The supervision problem
Continuous supervision sounds reasonable until you try to staff it. A single agent might take thousands of actions a day. No human team can review that volume in real time, which is why Microsoft is pitching Project Perception as an automated layer rather than a dashboard for analysts to stare at. The system has to make judgment calls about what counts as anomalous behavior.
That raises its own questions. If the monitor is also an AI system, what supervises the supervisor? Microsoft hasn't detailed how Project Perception makes decisions or how often it escalates to a human. The company's public statements focus on the need for the layer, not the mechanics of it.
Where this goes next
Microsoft hasn't given a release date for Project Perception or said which of its enterprise products will include it. For now, the project is a stated direction rather than a shipping feature. Companies evaluating agentic AI will want to know whether containment tools like this arrive before or after the agents themselves become standard infrastructure. Microsoft's answer, in effect, is that the two have to arrive together.
