AI agents: Evidence and scope
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 7
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
What the source establishes
Microsoft’s 19 October guidance treats agents as active enterprise participants with identities, tools and permissions. It argues for controls across the agent’s environment and actions. This is a vendor security position, not a report that every AI agent is compromised or an independently measured rate of insider incidents.
Research reviewed 22 October 2026: Microsoft: Securing the agentic insider. Vendor security guidance revisited.
Where the evidence stops
Model behavior and business authority are different layers. Monitoring or a second model cannot by itself prove that a consequential action is authorised.
Use this report as a dated interpretation. A vendor notice establishes what that vendor reports; a research observation establishes what the researcher observed. Neither automatically answers the account-specific question for your business. Record later changes to the source before relying on its versions, deadlines or recovery sequence.
Establish your own scope
List each agent’s tools, identity, data access, spending scope and approval path. Include scheduled agents and connections that survive beyond the employee session that created them.
- Identify the exact service, artifact, account or device relevant to your business, with a responsible owner.
- Record whether the source applies to that asset and what evidence supports the match.
- Separate evidence of exposure, evidence of activity and evidence of business impact. Leave unanswered questions explicitly open.
What would change the assessment?
Test denied actions and approval bypass attempts with safe synthetic data. Verify that revocation stops scheduled and in-flight actions, and that logs identify the approving human when required.
Revisit the decision when the provider changes scope, a new account-specific notice arrives or local evidence contradicts the current assumption. Preserve the earlier conclusion and the reason it changed. Do not silently turn a precaution into a confirmed breach, or an absence of telemetry into proof of safety.
Decision checkpoint
Allow production actions only within a documented scope that has passed denial, approval and recovery tests.