"Frontier models, regardless of their origin, cannot be trusted." That sentence did not come from a skeptic or a regulator. It came from the head of Microsoft's security business, while launching a product.
A recent piece on TechCrunch covered the launch of Guardian Agents, a feature that monitors the AI agents a company has deployed. The product is interesting. The framing is more interesting.
From outside attacker to inside employee
Microsoft's earlier security work, Project Perception, assumed the AI threat came from outside. It used red team agents to attack, blue team agents to detect and green team agents to fix. That is the classic model: build walls, watch the gate.
The new framing moves the threat inside the building. Satya Nadella has been arguing that the risk may be the agents enterprises have deployed themselves, behaving like a rogue employee. Security people have a name for that: the insider threat.
Hayete Gallot, who runs Microsoft's security business, was careful about why. The models are not malicious or easily hacked. They are unpredictable. They were trained to complete tasks, not to follow "organizational norms or judgment", and they are often handed broad access to data and tools.
The sentence that matters
Nadella put the principle in one line: "We need to separate the supply of intelligence from the authority over it." He also wrote that a model provider's assurances do not relieve a company of responsibility for what intelligence does on its behalf.
This is the part I would underline for every executive team. The company that sells you the agent should not be the only one watching it. That is not a statement about bad intent. It is the same logic as auditor independence, which exists because nobody grades their own exam well.
Yes, the move is self-serving. Microsoft invests in both OpenAI and Anthropic and runs its own model lab, and it would clearly prefer you buy agent security from your cloud provider rather than from the labs. The logic still holds. Good arguments do not become wrong because someone profits from them.
What the tooling actually does
The concrete features tell you where the risk sits. Microsoft Defender can now detect up to 60 types of agents employees bring to work on their own, including Claude Code, Codex and OpenClaw. There are controls to limit agents' access to data and systems, and to adjust permissions dynamically based on the task.
There is also a human approval step when an agent appears to be making risky decisions. And Microsoft joined Nvidia's Open Agent Safety Platform, backed by more than 100 companies, which isolates agents in secure environments and can stop them at the hardware level, effectively a kill switch.
Read that list as a map of failure modes. Unknown agents running on company data, agents with more access than the task requires, and agents taking irreversible actions without anyone noticing. None of these are science fiction. All of them are happening in companies right now, mostly unrecorded.
Most companies are not ready for this
In my experience, agent adoption in mid-market companies follows a predictable path. A few people start using tools on their own. A team lead builds an automation on a personal account. Six months later, something important depends on an agent nobody formally approved, connected to a shared inbox and a CRM.
That is exactly the pattern Microsoft is now selling detection for. I wrote earlier that AI agents need employee identities, with their own access rights, logs and an owner. The insider-threat framing is the security version of the same idea. If an agent can act like an employee, it needs to be managed like one, including offboarding.
There is a commercial angle too. If the only oversight you have is the dashboard your model vendor provides, you are also locked in. I made that argument in don't let one vendor own your agents. Independent oversight is what lets you swap the model without losing control.
A practical oversight architecture
You do not need Microsoft's whole stack to apply the principle. Start with an inventory: every agent, automation and AI integration touching company data, who owns it and what it can access. Most companies are surprised by the length of that list.
Then separate permissions by risk. Reading data, drafting content and summarizing are low risk. Sending external messages, moving money, changing records and deleting anything are high risk and should require a human approval or a hard limit. Write those tiers down.
Third, log everything outside the agent itself. The record of what an agent did should live in a system the agent cannot edit, owned by someone other than the team that built it. That is the independence Nadella is describing, at a scale a 50-person company can manage.
If building that layer in-house is not realistic, difrnt.ai (difrnt.ai) builds custom AI solutions end-to-end, including the permissions and logging around them. Whoever builds it, the design rule is the same.
Finally, test the off switch. Can you stop every agent in the company within an hour if something goes wrong? If the honest answer is no, that is the first project, before any new deployment.
The smartest people selling AI are now telling you not to trust it blindly. Take them at their word, and build accordingly.