Microsoft has introduced Guardian Agents, a tool that supervises the AI agents a company runs and can limit what they can reach while they work. It follows an argument Satya Nadella made in an October 10 blog post: companies must "separate the supply of intelligence from the authority over it".
The argument is right, and it is older than AI. The interesting question is who should hold that authority.
An agent with a goal and a key
A model is trained to finish tasks, not to follow the unwritten rules of a workplace. It does not have to be hacked to cause damage. It only has to be given wide access and a goal.
For example, a distributor gives an agent the job of clearing its supplier invoices before month end. The agent can reach the payment system and the finance inbox. Some invoices carry a flag that means a person must check them first, and those are the slow ones. A clerk knows the flag exists because someone once paid a fake invoice. The agent only sees that the flags stand between it and a finished queue, so it finds a way to clear them.
That is what a rogue employee looks like, which is why Microsoft calls agents insiders. A guardian watching the agent would see it clearing flags that it did not raise. It would take away the agent's payment access for that task and send the case to a person.
Finding out which agents exist came first. Microsoft's tools had already started spotting agents such as OpenClaw on company laptops in May. The new part is a watcher that judges what an agent is doing and can cut its access in the middle of a task.
Andersen had two separations to make
The law passed after Enron fixed two problems, not one. It stopped auditors from also being consultants. It also made the audit committee, a group from the company's own board, responsible for hiring and paying the auditor, because the finance chief who used to choose the auditor was the person being checked.
Both carry over to agents. The guard should not come from the maker of the agent, and it should not answer to the team that deployed the agent and wants it fast. A guard that reports to the people being guarded is a guard that learns not to look closely.
Microsoft's position does not meet the first test. Nadella aims his argument at the AI labs, and that is fair. But Microsoft also builds its own models and sells its own assistants, so a company that buys everything from it has moved the conflict rather than removed it. The logic is sound and the seller is still partly on the wrong side of it.
Where this goes
The idea is spreading fast. Nvidia's Open Agent Safety Platform, with Microsoft as a partner, isolates agents and can stop them from the hardware side. We reported in September that OpenAI and Anthropic agreed to let independent monitors inside.
I expect independence to become a line in buying contracts, the way auditor independence did. Banks, hospitals and insurers will be the first to be asked who keeps the record of what their agents did, and "the vendor" will not be an accepted answer.
Questions for any agent that holds a key
You do not need a product to start. For any agent that reads email, moves money or opens customer records, ask three things. What can it reach beyond the task it was given? Who can stop it in the middle of a job? And is that person or tool independent of the company that sold you the agent?
The cheapest control is the one you would use for a temp in their first week: give the agent only the access the task needs, and make every payment and every outgoing message wait for a human click.