Microsoft Hires AI Agents to Babysit Other AI Agents at Work
Enterprises have spent the past two years handing AI agents real jobs: reading expense receipts, approving reimbursements, moving data between systems. To do any of that, an agent needs permission to open documents and operate the software behind them. The trouble is that an agent which misreads a task, or gets talked into the wrong one, can do damage at machine speed before a human notices.
On October 19, Microsoft said it was adding a new layer of watchers to Project Perception, its security system for enterprise agents. The watchers are themselves AI agents. They follow the other agents around, check what they are doing, and when something looks off, trace the cause, pull back permissions, and if necessary shut the worker agent down. The company’s own framing is blunt: to stop an AI insider, put another AI on guard duty.
The move reflects a shift in how companies think about automation. The first wave of agent tools sold themselves on autonomy — let the model handle the whole task. The second wave is selling supervision. An agent with access to a reimbursement system is a small employee with a badge, and like any employee it needs someone reviewing its work. Microsoft’s answer is to make that reviewer cheap and tireless, rather than hiring more people to watch dashboards.
That has implications for the middle of the corporate hierarchy. Middle managers have long been the layer that checks work, catches mistakes and escalates exceptions. If agents can do the routine checking, the argument goes, that layer does not disappear — it changes shape. People move up to setting policy, defining what counts as an exception, and handling the cases the monitors cannot resolve. The monitoring agents only know what they were told to consider suspicious.
The technical challenge is real. A guard agent has to understand what a worker agent was trying to do, which means reading the same logs and tool calls, and it has to be fast enough to intervene before a payment goes out. False alarms are costly too: an overzealous monitor that freezes a legitimate workflow will annoy the teams it is meant to protect. Microsoft has not disclosed how the system decides when to revoke access versus simply flagging activity for a human.
Enterprises are watching closely because agent deployments are multiplying faster than the security tooling around them. The same permissions that make an agent useful are the ones that make it dangerous, and few companies have built clear rules for what an agent may do unsupervised. Vendors that can offer a credible answer — including a paper trail showing what an agent did and why it was stopped — have an easier sales pitch.
For now the product is a signal about where the market is heading: from building agents to governing them. The next thing to watch is whether customers report the monitoring agents catching real problems, or mostly generating alerts that humans end up dismissing.