Microsoft is rolling out a new set of security controls aimed at AI agents that go off-script. The company is introducing dynamic permissions and risk scoring for these autonomous tools, a move that shifts how enterprises monitor and contain AI systems after they've been deployed.
The approach replaces static access rules with continuous risk assessment. Instead of granting an AI agent a fixed set of permissions at setup, Microsoft's system adjusts what an agent can do based on its behavior and a running risk score.
Why static permissions fall short for AI agents
Traditional access controls assume a program will do roughly what it was built to do. AI agents don't always fit that model. They can chain actions, call other tools, and encounter situations their developers didn't anticipate. Once an agent has broad permissions, it can keep using them even when its behavior starts to drift.
Microsoft's dynamic permissions are designed to close that gap. The system evaluates an agent's actions as they happen and can tighten or loosen its access accordingly. Risk scoring gives administrators a way to rank which agents are behaving unpredictably and need attention first.
The company frames the change as a shift toward continuous risk assessment — a departure from the set-and-forget model that has dominated enterprise security for years.
What continuous risk assessment means in practice
For security teams, the appeal is visibility. An agent that starts requesting unusual data or attempting actions outside its normal pattern would see its risk score rise. That score can then trigger a permission change, putting a brake on the agent before it does damage.
The details of how Microsoft calculates those scores, and how quickly permissions adjust, aren't public yet. What is clear is the direction: the company wants to treat AI agents less like trusted software and more like entities that need ongoing supervision.
That has implications for how enterprises set up their AI deployments. Security policies that assume a fixed permission set will need to account for agents whose access can change mid-task. Audit trails will matter more, not less, because administrators will need to reconstruct why an agent had certain permissions at a given moment.
The enterprise security angle
Microsoft's move may influence how other enterprise security vendors approach AI agent controls. If dynamic permissions and risk scoring become standard, companies that sell static access management for AI tools will face pressure to add similar features.
The company's own security strategy is also in play. Microsoft has been building out its AI security portfolio, and this announcement positions it as an early mover on a problem that enterprises are only starting to grapple with: what to do when an AI agent behaves in ways its creators didn't intend.
For now, the measures are a signal that Microsoft sees rogue AI agents as a real operational risk, not a hypothetical one. The company hasn't said which products will get the controls first or when they'll be generally available.
What enterprises should watch
The next step is for Microsoft to publish technical details that let security teams evaluate the system. How risk scores are calculated, what triggers a permission change, and how quickly an administrator can override the system will determine whether dynamic permissions are practical at scale.
Enterprises running AI agents in production will also want to know how the controls integrate with existing identity and access management tools. Microsoft hasn't addressed that yet.
The company's announcement stops short of a timeline. Until those details arrive, the shift toward continuous risk assessment remains a direction rather than a deployable product.
