Guardian agents for AI Agents: The agent security solution?

AI agents are getting access to our most sensitive data, connecting to critical business systems, and making decisions that once required human judgment. They can write code, manage workflows, analyze financial information, and take action across an organization with minimal supervision.

But who is watching the agents?

On October 19, Microsoft introduced Guardian Agents, a new capability within its Project Perception security initiative designed to help monitor and protect AI agents. The announcement reflects a growing recognition across the cybersecurity industry: the next major AI security challenge may not be an attacker breaking into your organization. It may be an agent already inside it.

The concept is straightforward. If AI agents are becoming autonomous participants in the enterprise, they need their own layer of security oversight. Think of them as guardian angels: an independent security mechanism that watches what agents do, identifies risky behavior, and intervenes when necessary.

But there is a deeper reason this kind of protection is becoming essential. AI agents do not always behave as their creators, operators, or users intended. Their actions can gradually diverge from their original purpose, even when they have legitimate access and are operating as designed.

This is agent drift, and it is one of the fundamental problems that guardian mechanisms must solve.

The insider threat has a new identity

Traditional cybersecurity is built around familiar questions. Who is accessing our systems? Are they authorized? What data can they reach? Are they exhibiting signs of compromise?

These questions remain important, but AI agents complicate the answers.

An agent might be legitimately deployed by an employee, authenticated through an approved identity, and granted access to several business applications. It might have permission to read customer records, update a CRM, create support tickets, or execute code.

None of those permissions necessarily indicates a security problem.

The risk emerges when the agent starts using those permissions in unexpected ways.

An employee who has access to customer records is still expected to follow company policies and exercise judgment. Similarly, an AI agent should not be considered safe simply because it has been granted access to a system. Authorization establishes what an agent can do. It does not establish whether a particular action is appropriate.

Microsoft has begun framing this challenge in terms of the agentic insider threat. In its October 19 security announcement, the company argued that organizations cannot rely solely on AI model providers to ensure their agents behave safely.

The concern is not necessarily that agents are malicious or that their underlying models have been compromised. It is that these systems are designed to accomplish objectives, not reliably apply every organizational norm, business rule, or contextual judgment that a human employee might be expected to understand.

Agents can be capable, authorized, and still make the wrong decision.

And unlike a human employee, an agent can execute actions at machine speed, across multiple systems, potentially repeating a mistake before anyone notices.

Agent drift: when actions stop matching intent

Agent drift occurs when an AI agent’s actions diverge from the purpose, instructions, or boundaries established for it.

This can happen in obvious ways, such as an agent performing a task it was explicitly told not to perform. But the more difficult cases are less dramatic. An agent may complete its assigned task while taking a series of unnecessary, risky, or unintended actions along the way.

Consider an AI agent deployed to help a sales team prepare for customer meetings. Its intended purpose is to gather relevant account information, summarize recent interactions, and prepare a briefing for the salesperson.

The agent has access to the CRM, internal documents, and customer support records. Those permissions make sense for its job. Now imagine that while preparing a briefing, the agent decides it needs more context. It searches additional repositories, collects customer information beyond what is necessary, and transfers the resulting dataset into another tool to produce a more comprehensive report.

The agent may believe it is right on track.

But its behavior has drifted from the original task. It has expanded the scope of its activity, accessed information it did not need, and potentially moved sensitive data into an unintended destination. Nothing in this scenario necessarily requires a stolen credential, a compromised account, or an explicit permissions violation. The agent can create risk while operating through legitimate access.

That is what makes agent drift so challenging to detect.

Drift can emerge from ambiguous instructions, changing context, unexpected outputs, misleading information encountered during a task, or an agent’s attempt to find an alternative path toward its goal. It can also arise when an agent chains together individually reasonable actions that collectively produce an unintended outcome.

In other words, an agent does not have to break its rules to create a problem. Sometimes, the rules simply do not capture what the agent should actually be doing.

Why traditional security controls miss the point

Existing security tools remain essential for protecting identities, applications, data, and infrastructure. But agentic systems introduce a behavioral dimension that conventional controls were not designed to address on their own.

Identity and access management can establish which agent is operating and what resources it is allowed to access. Least-privilege controls can reduce the damage an agent could cause. Activity monitoring can record which applications it accessed, which files it retrieved, and which operations it performed.

These are necessary foundations. They are not the whole answer.

Consider three different questions:

• Identity: Is this the agent we expect to see?
• Authorization: Is this agent permitted to perform this action?
• Intent alignment: Does this action make sense given what the agent was supposed to accomplish?

The first two questions can often be answered through established security controls. The third requires a different kind of context.

A legitimate agent can perform an authorized action for an unintended reason. An individual operation can look harmless while contributing to a risky sequence. A permission can be appropriate for one task but excessive for another.

Even comprehensive activity logs do not automatically reveal these problems. Visibility tells security teams what happened. Detecting drift requires understanding what should have happened and identifying meaningful differences between the two. Without that context, organizations risk discovering agent behavior only after it has produced an undesirable outcome.

Guardian agents: an independent layer of oversight

This is where the concept of guardian agents comes in.

Rather than relying entirely on the agents themselves or the companies that supply their underlying models, organizations can introduce a separate layer of security to observe agent activity, assess risk, and enforce boundaries.

Microsoft’s Guardian Agents announcement is part of this broader shift. The company is expanding Project Perception, which initially focused on identifying and addressing external cyber threats, to account for the risks posed by agents operating within the enterprise. Microsoft has also announced expanded agent discovery and access-control capabilities across its security offerings.

The principle extends beyond Microsoft’s products. In its research on platform-agnostic guardian agents, Gartner has highlighted an emerging approach to AI agent governance and security that emphasizes visibility, runtime controls, and oversight across agent ecosystems.

The word platform-agnostic is particularly relevant. Enterprises increasingly use agents from different providers, built into different applications, and developed by employees using different tools. A security approach tied exclusively to one model provider or agent framework can leave gaps elsewhere in the organization.

Independent oversight helps separate two responsibilities: supplying intelligence and controlling the authority that intelligence receives. This separation matters because organizations, not model providers, ultimately remain accountable for business decisions, sensitive data, and the actions performed on their behalf.

A guardian layer can help organizations discover agents, observe their behavior, evaluate activity against security policies, and respond when actions become risky. Depending on the implementation, that response might involve restricting access, requesting human approval, or stopping an operation.

But the real value of a guardian is not simply that it can see more activity. It is that it can help determine when activity has become inconsistent with the agent’s intended role.

From monitoring activity to detecting drift

For guardian agents to address the underlying problem, security teams need to move beyond asking whether an agent is active or whether its actions fall within a list of permitted operations.

They need to understand the relationship between intent and behavior.

That starts with establishing what an agent is supposed to do. What task was it assigned? What systems and information does it need? What actions are appropriate for that task? What boundaries should remain in place even when the agent encounters an unexpected situation?

The next step is observing what actually happens. Which resources does the agent access? What actions does it take? How does its behavior change as the task progresses? Does it begin expanding the scope of its activity or pursuing a different objective?

Finally, security teams need to identify meaningful deviations and respond before those deviations turn into incidents.

This is not simply a matter of flagging every unusual action. Agents often need flexibility to complete complex tasks, and unexpected behavior is not automatically dangerous. Effective oversight requires context to distinguish reasonable adaptation from risky drift.

An agent researching a customer account might legitimately consult several sources. The same activity could become problematic if it starts collecting unrelated sensitive records or sending information to an unauthorized destination.

The difference lies in the purpose of the task, the context of the actions, and the boundaries established for the agent. Security that accounts for these factors can help organizations intervene based on the behavior that matters, rather than relying exclusively on static permissions or isolated alerts.

The WithWings perspective: keep actions aligned with intent

At WithWings, we believe the central challenge of agent security is not simply knowing which agents exist or recording everything they do. It is preventing the gap between agent intent and agent action from becoming a security blind spot.

Our approach to AI Posture Management is built around discovering agents, monitoring their behavior, and identifying when their actions drift from their intended purpose.

That distinction is important in environments where agents can operate across multiple applications, identities, and data sources. A security team needs to understand the agent ecosystem, establish the context for agent activity, and recognize when behavior departs from expectations.

An agent’s permissions tell only part of the story. Its activity provides another part. Connecting that activity to intent is what makes it possible to identify drift.

This is also why agent security cannot be reduced to a simple choice between trusting and distrusting AI. Organizations do not need to assume that every agent is a threat. They need to recognize that autonomous systems can make mistakes, misinterpret instructions, and pursue objectives in unintended ways.

The answer is not to eliminate autonomy. It is to make autonomy governable. With independent oversight and intent-aware security, organizations can give agents the access they need while maintaining visibility into what they actually do and detecting when their actions move beyond the intended scope.

Your agents can be autonomous. Your security shouldn’t be on autopilot.

Guardian agents represent a broader evolution in enterprise security. As organizations give AI agents more responsibility, they need controls that account for the distinctive risks of autonomous behavior. Identity protection and access governance remain essential. Monitoring and detection remain essential. But neither can fully address the possibility that an agent with legitimate access may gradually move away from its intended purpose.

Agent drift brings that problem into focus. The challenge is not just preventing unauthorized access. It is ensuring that authorized agents continue acting within the boundaries of their intended tasks. The organizations best prepared for the agentic era will be those that treat security oversight as an independent responsibility, not an assumption delegated to the models and tools they deploy.

So what’s the bottom line? Organizations needs to know when an agent has gone off course. Guardian agents are an indication of how essential it is to utilize agentic workflows to govern AI, but they are not the answer to every AI security problem. A combination of observability, monitoring, drift detection, remediation and auditing is the solution. Want to see what your agents are up to? Get a demo today.