微软宣布了用于控制 Microsoft 365 E7 和 Project Perception 平台中 AI 代理的新工具。这些工具限制每个代理可以访问的内容，并在其风险增加时收紧这些限制。
Microsoft has announced new tools to control AI agents in Microsoft 365 E7 and its Project Perception platform. The tools limit what each agent can reach and tighten those limits when its risk increases.
微软安全执行副总裁 Hayete Gallot 在周一的一篇帖子中阐述了这一做法。她写道，公司应将 AI 代理视为内部人员。代理可以访问数据、工具和系统，常被赋予过多的访问权限，并且可能以意想不到的方式行事。
Hayete Gallot, executive vice president of Microsoft Security, set out the approach in a post on Monday. She wrote that companies should treat AI agents as insiders. Agents can reach data, tools, and systems, are often given too much access, and can behave in unexpected ways.
Gallot 表示，每个代理都应由 Guardian Agents 监控，这些代理会在其行为发生前进行检查。她还呼吁开发能够展示模型推理过程的安全工具，而不仅仅是其输入和输出。
Gallot said every agent should be watched by Guardian Agents, which check its actions before they happen. She also called for security tools that show a model’s reasoning, not just its inputs and outputs.
这些功能本身在 Nadim Abdo（身份和网络访问公司副总裁）的一篇独立帖子中进行了阐述。两篇帖子均基于 Satya Nadella 本月早些时候的一篇文章，他在文章中表示，公司应将模型视为内部风险。
The features themselves are set out in a separate post by Nadim Abdo, corporate vice president for identity and network access. Both posts build on an essay by Satya Nadella earlier this month, in which the chief executive said companies should treat models as insider risks.
主要新增功能是动态权限（Dynamic Permissions）。根据该功能，代理初始时没有自身的访问权限，仅在执行单个任务期间获得完成该任务所需的权限，任务持续多久，权限就保留多久，公司表示。代理永远无法获得其未被授予的访问权限。
The main addition is Dynamic Permissions. Under it, an agent starts with no access of its own and gets only what it needs for one task, for as long as the task lasts, the company said. It can never get access it does not have.
微软还在添加动态代理风险（Dynamic Agent Risk），该功能会持续为每个代理评分。它利用来自身份、数据、设备、云、网络以及代理自身行为的信号。
Microsoft is also adding Dynamic Agent Risk, which rates each agent continuously. It uses signals from identity, data, devices, cloud, network, and the agent’s own actions.
第二个功能是动态条件访问（Dynamic Conditional Access），它将 Entra 控制扩展到代理。当风险上升时，响应将分步进行。代理可能失去修改文件的权利但保留读取访问权限，失去对某些数据的访问，需要人工批准某一步骤，或被完全停止。
A second feature, Dynamic Conditional Access, extends Entra controls to agents. When risk rises, the response comes in steps. An agent can lose the right to change files but keep read access, lose access to some data, need a human to approve a step, or be stopped.
微软现在还能够发现运行在员工设备上的 35 种额外类型的代理，总数达到 60 种。
Microsoft can now also find 35 more types of agents that run on staff devices, for a total of 60.
这些包括 Anthropic 的 Claude Code、OpenAI 的 Codex 和 GitHub Copilot。Entra Agent ID 为每个代理提供独立于其用户的身份，将覆盖这些代理以及其他未知代理。
These include Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot. Entra Agent ID, which gives each agent its own identity separate from its user, will cover these and other unknown agents as well.
与此同时，微软正在为 Project Perception 添加 Playbooks 和一支 Guardian Agents 团队。这些功能将调查代理风险变化的原因，并能够提出或应用限制措施。
Meanwhile, Microsoft is adding Playbooks and a team of Guardian Agents to Project Perception. These look into why an agent’s risk changed and can suggest or apply limits.
“在微软，我们已经在一个拥有数十万个代理的世界中运营，”微软副首席信息安全官特雷尔·考克斯在该帖子中表示。
“At Microsoft, we are already operating in a world of hundreds of thousands of agents,” Terrell Cox, Microsoft’s deputy chief information security officer, said in the post.
此外，代理可以在诸如微软执行容器（Microsoft Execution Container）之类的沙盒中运行。公司表示，这能够让监控代理的安全控制措施脱离该代理的可及范围，即使该代理被黑客入侵。
In addition, agents can run inside sandboxes such as Microsoft Execution Container. The company said this keeps the security controls that watch an agent out of that agent’s reach, even if it is hacked.
他们尚未透露新功能何时可用，或这些功能是否会在 Microsoft 365 E7 许可证基础上产生额外费用。
They did not say when the new features will be available, or whether they will cost extra on top of a Microsoft 365 E7 licence.