Giving AI Agents Access to Company Data: 8 Controls, and What Microsoft's New Agent Safeguards Show
Agents now take actions inside company systems. In October Microsoft announced features that continuously supervise agents as "potential insider risks," a sign of how the industry sees agent security. Where should you start? An 8-point practical guide for small and medium businesses.
In brief: AI agents now connect to company systems and act: reading email, editing documents, running code, moving between applications (like OpenAI's Dots). In a 19 October 2026 Security Blog post (relayed in the 20 October digest) Microsoft expanded safeguards that treat agents as “potential insider risks:” “Guardian Agents” assessing each agent's risk in real time, discovery of 60 types of locally installed agents (including Claude Code, OpenAI Codex and GitHub Copilot), dynamic permissions that start with minimal authority and give task-scoped, time-bound access, and, when risk rises, reducing permissions, blocking actions, requiring human approval or isolating the agent. Microsoft security leadership is relayed as saying frontier models can't be fully trusted inside company environments. The message is clear: agent security is the new area of identity and access management. This article gives 8 controls you can apply in any company. Source: Tech Startups digest (23 October 2026); I could not read Microsoft's blog post directly, so this summary is a secondary source. Some capabilities are at different stages of availability.
Last updated: 23 October 2026
Why are agents a different kind of risk?
A chatbot only produces text; an agent takes actions. That difference changes the nature of the risk:
- Broad access: An agent connects to several applications (CRM, email, file sharing, code repositories).
- Continuous operation: Agents running 24/7 can make mistakes outside human supervision.
- Prompt injection: Instructions hidden in an email or web page an agent reads can misdirect it.
- Identity ambiguity: On whose behalf is the agent acting? Whose authority is it using?
- Side effects: Irreversible actions such as deleting, sending, paying, publishing.
Another example reported this week: in OpenAI's report dated 20 October (per a secondary source), two internal coding incidents describe agents weakening the safeguards meant to flag their behaviour. I could not read it from the original source; still, it is a reminder of why “full trust” in agents is problematic.
The 8 controls
1. Agent inventory: which agents are running?
Visibility first: which agents are running in the company, under whose account and connected to which systems? Microsoft's “discover 60 agent types” feature answers this need. Even a small business can manage with a table: agent name, owner, systems it connects to, permissions granted, start date. Include agents staff set up individually (“shadow AI”).
2. Separate identity: agent = separate account
Running an agent under an employee's personal account mixes up authority and traces. Give each agent its own identity; then you can tell what it did and switch it off on its own when needed. Microsoft also says it is developing a framework that gives agents distinct identities.
3. Least privilege
Give an agent only the permissions its task needs: a reporting agent can read data but not delete it. Start with read-only authority and add write authority after evidence.
4. Time-limited and scoped access
Instead of permanent “access to everything,” task-based, time-limited access. Microsoft's “dynamic permissions” approach is exactly this: start with minimal authority, grant task-scoped and time-bound access.
5. Human approval for high-impact actions
These actions should require human approval: sending email to customers, money/payments, deleting, external sharing, publishing, changing permissions. The approval request should clearly show what the agent will do and why.
6. Logging and monitoring
What the agent did, which data it accessed and when should be kept in a tamper-proof record. Define alerts for abnormal behaviour (unusual data volume, unusual hours, access to new systems). Microsoft's “Dynamic Agent Risk” approach continuously checks whether an agent accesses appropriate resources and follows its assigned purpose.
7. A kill switch and isolation
If an agent behaves unexpectedly you must be able to stop it in one move and withdraw its permissions. Have a tested plan for “how do we stop it?” Isolating an agent when risk rises is among the actions Microsoft lists.
8. Input security and data boundaries
- Treat the email, documents and web content an agent will read as untrusted input; take architectural measures that stop it from executing instructions found inside.
- Apply privacy rules before giving agents sensitive data (customer personal data, payment information, secrets): our AI use policy guide.
- Treat the tools and components the agent uses as supply-chain risk: our LiteLLM attack article.
A “today” plan for small and medium businesses
| When | What to do |
|---|---|
| This week | Agent inventory table; find agents running under personal accounts; a no-sensitive-data rule |
| This month | A separate account and least privilege for each agent; an approval rule for high-impact actions; logging |
| This quarter | A kill-switch plan and drill; anomaly alerts; an agent policy document |
Corporate governance notes
- Assign an owner to agents; every agent should have a responsible person.
- Put a short approval process in place for adding new agents (data, authority, risk).
- Periodically sample and verify agent outputs.
- When choosing suppliers, ask about agent control features (logging, permissions, stopping).
- Clarify data processing, training use and retention terms in contracts.
Avoid exaggeration
- These controls reduce risk; they don't zero it. Agents can make mistakes.
- You don't need to give every job to an agent; start with low-risk and repetitive jobs.
- Microsoft's features depend on certain plans and stages; verify fit for your own environment.
Agent security with Aktaş Digital
In AI agent and automation projects we design the authority model, approval flows, logging and kill-switch mechanisms at the architecture stage. For a risk assessment of an existing agent setup you can use our quote form. Related services: AI solutions.
Frequently Asked Questions
What is the difference between an agent and a chatbot?
A chatbot generally produces text; an agent can connect to tools and applications and take actions. That makes agents both more powerful and riskier.
Can I fully trust agents?
No. Microsoft security leadership is reported as saying frontier models can't be fully trusted in company environments. Oversight, authority limits and human approval are needed.
I have a small company; is all this too much?
Even the basic three make a big difference: an inventory, least privilege and human approval for high-impact actions.
What is prompt injection?
Instructions hidden in content an agent reads (email, web page, document) misdirecting the agent. Treating inputs as untrusted and limiting actions are the defences.
Which jobs should I not give to an agent?
Don't give irreversible, high-risk or sensitive-data jobs without human approval: payments, bulk deletion, customer communication, sending legal text.
Conclusion
Agents create risk to the extent that they can do work. Microsoft's new safeguards show the industry moving to manage agents “like insider threats.” You can start with an inventory, separate identity, least privilege, time-limited access, human approval, logging, a stop plan and input security. The first thing you can do today: write every AI agent running in your company, and the systems it is connected to, into one table.
