Writing

AI agents with credentials are unmanaged insiders

For years, insider threat meant a person with legitimate access doing something off-script. Controls were built around identities, roles, and audit logs. The working assumption was that the user was human, that access mapped to a job function, and that intent could be inferred from behavior. A lot of security tooling still rests on that assumption, even though the definition of 'user' has been quietly expanding.

Microsoft's reframing

Microsoft's new stance, reported by TechCrunch, changes that. If an AI agent holds credentials and can act without asking, it is already an insider—just one that does not share your org's norms. Frontier models cannot be trusted with authority. They do not need to be malicious to cause damage; they need only to lack the implicit context humans carry. That includes the unwritten rules about what is acceptable, the instinct to double-check before a high-impact change, and the understanding that some actions should never be fully automated. An agent that can read and modify production systems is not a tool anymore; it is a participant with all the risk and none of the social contract.

Separating intelligence from authority

The core principle that lands for me is separating the supply of intelligence from the authority over it. An agent can be very good at generating plans, summaries, code, or recommendations. That does not mean it should be able to execute them. Intelligence is cheap to request; authority is expensive to grant. Keeping the two separate is the difference between using an agent as an advisor and handing it the keys. The same model already exists in high-risk industries: the analyst who can recommend a trade is not the same person who approves it.

• Narrow scoped permissions, granted per task and revoked when done.
• Human approval on high-impact actions.
• Independent monitoring that does not rely on the agent's own logs or self-reporting.

None of these are new ideas. Identity and access management, change approval, and audit logging have existed for decades. What is different is that we used to apply them to people with a shared understanding of the organization. An agent has no shared understanding until you encode it, and even then it follows instructions literally. The controls have to become more explicit and less forgiving. A permission that is too broad for a person is also too broad for an agent, but the agent will not pause to ask whether this particular action is a good idea.

What changes next

Watch for agent detection in Microsoft Defender becoming baseline, not a premium feature. If Microsoft is serious about this framing, detection for agent behavior should not be locked behind a premium tier. It needs to be baseline because the threat is not exotic—it is the same insider risk problem with a different kind of actor. I will be watching whether agent-specific signals show up in default telemetry, not just in advanced hunting or high-tier SKUs. That is the real test of whether this is a product direction or just a thought leadership piece.

The agents aren't employees.

Until they can follow org-specific guardrails reliably, treat every autonomous credential as an unmanaged insider. That is not a policy detail; it is a mental model. The moment you give an agent credentials and permission to act, you have added a new insider to your environment. You just have not onboarded it, trained it, or given it the cultural context that makes a human employee predictable. The phrase 'unmanaged insider' is useful because it keeps the risk concrete instead of abstract.

The practical shift is not to ban agents. It is to hold them to the same standard you would apply to a contractor with a badge: limited access, supervision on anything that matters, and separate oversight. That is a useful place to start, and it avoids both the hype and the panic. If an agent cannot meet that bar, it should not have the credential, regardless of how impressive the model is.

Originally covered at techcrunch.com ↗