Microsoft says frontier models can't be fully trusted: every AI agent needs a named human owner

On 19 October 2026 Microsoft published "Securing the agentic insider", written by Hayete Gallot, executive vice president of Microsoft Security. It argues that frontier models cannot be fully trusted, regardless of origin, not because they are malicious but because they are trained for results and not around an organisation's norms. It describes AI agents as "agentic insiders": software that holds access to data, tools and systems and can act inside critical processes.

The same day Microsoft's Security blog set out what it is introducing. Guardian Agents in Project Perception supervise what other agents do, continuously. Dynamic Permissions limit an agent to a task and remove access when the task ends. Agent discovery expands to 60 types of local agents, including Claude Code, OpenAI Codex and GitHub Copilot. Satya Nadella wrote that a model should not be asked "to be its own security authority". The posts give no general availability dates or prices.

This matters beyond security teams. Agents are already being switched on by staff, teachers and pupils, often without anyone deciding who is responsible for them. Microsoft is describing what happens when an agent holds the same access as a person and nobody is watching what it does with it. Any school, college or employer that lets an agent read files, send messages or change records has the same question to answer.

Dan Fitzpatrick's reading is that Microsoft is right about the risk and right that supervision cannot be left to the agent itself. His caution is that a monitoring product is not an owner. Software can flag, restrict and shut down an agent. It cannot be accountable to a parent, a governor or a customer. The organisations that cope best will be the ones that treat agents like staff: given a purpose, limited access, and a named human who answers for them.

Dan's advice for school leaders, trust boards and business leaders is practical. List every agent, assistant and AI tool that can act on your behalf, including ones staff installed themselves. Name one person responsible for each. Give each only the access its task needs, and require a human to approve anything that touches pupil data, money or records. Ask suppliers, including Microsoft, how you can see and stop what an agent has done. Then teach staff and pupils to check the work, so the thinking stays with people.

Dan advises schools and organisations on adopting AI, and has spent years helping teachers and leaders put practical guardrails around tools their staff are already using. His focus is on what AI changes for people: learning, work, leadership, children and trust.

Dan Fitzpatrick is available for interview and comment on this story. He is available today for live or pre-recorded radio, TV, podcast and print interviews, with a broadcast-quality remote setup for live or pre-recorded down-the-line interviews. Contact: dan@theaieducator.io