On 19 October 2026, Microsoft told enterprises to treat AI agents as insiders. Give each agent its own identity, start it with zero permissions, and make a person approve anything high-impact. That advice fits a five-person company running one n8n agent as well as it fits a bank. The hard part is deciding which actions count as high-impact, so this note gives you a four-tier model and a planner to sort your own agent's tools in ten minutes.
Key takeaways
- Microsoft's October 2026 guidance: one identity per agent, no standing permissions, human approval for higher-impact actions (Microsoft Security Blog).
- Sort every tool with two questions: can you undo it within 5 minutes, and does it leave your company or move money?
- Take money, credential and delete permissions off the agent's key. Put an approval step in front of anything customers see.
01What did Microsoft say about AI agents?
In October 2026, Microsoft published two posts on the same day arguing that companies should govern AI agents the way they govern staff with system access. Hayete Gallot, who leads Microsoft Security, wrote that agents "are agentic insiders" and shouldn't be trusted by default. A second post, from Nadim Abdo, who runs identity and network access, listed the controls:
- Every agent gets its own identity, separate from the person who launched it.
- Agents start with no permissions and receive only what the approved task needs, for as long as it needs them.
- Higher-impact actions can require verified human approval.
- Defender's local agent discovery now recognises 60 agent types, including Claude Code, OpenAI Codex and GitHub Copilot.
TechCrunch reported that Satya Nadella had already argued earlier in October for monitoring systems that the AI labs don't control. Guardian Agents, the agents that would watch other agents, appear in Microsoft's post as a proposed category. Microsoft gave no release date for them, so treat this as guidance you can apply now with the tools you already have.
02Why does this matter if you don't use Microsoft?
OWASP reached the same conclusion from the attacker's side. Its 2025 Top 10 for LLM applications lists Excessive Agency (LLM06) and traces it to three causes. The agent has functions it doesn't need, those functions hold more access than the task requires, or the agent takes high-impact actions without approval. OWASP notes the trigger can be a hallucination, an ambiguous instruction, or text an attacker planted in content the agent reads.
Your model provider can't set these limits for you. The permissions live in your n8n credentials, your API keys and your database roles, and you control all three. A line in the system prompt asking the agent not to issue refunds is a request the model can ignore. Removing the refund scope from its API key is a control it can't get around. Microsoft's post makes the same point: put deterministic controls around a non-deterministic model.
03The four-tier model for AI agent permissions
List every tool your agent can call, then sort each one with this rule. It takes two questions and gives you the control to apply.
read-only → Tier 0
leaves the company, or undo takes over 5 min → Tier 2
everything else → Tier 1
| Tier | Covers | Control |
|---|---|---|
| 0 · Read | Reading the records the task needs | Runs alone. Scoped to those records. Logged. |
| 1 · Reversible write | Drafts, internal notes, files you can restore | Runs alone. Logged, rate-limited, undo path tested. |
| 2 · External or hard to undo | Customer emails, publishing, data customers see | Waits for a person to approve that specific action. |
| 3 · Money, keys, deletion | Refunds, payments, API keys, deleting records, role changes | The agent never holds the permission. A person does it. |
The 5-minute line is a rule of thumb. It's about how long a person takes to spot a bad action in a log and reverse it. If reversing takes longer, treat the action as permanent and move it up a tier.
04Worked example: an invoicing agent
Take a hypothetical invoicing agent sitting on a billing system like the one in Project Scribe, my document and invoicing platform. It reads timesheets, drafts invoices, renders PDFs and emails clients. Run its eight tools through the rule:
| Tool | Writes? | Undo in 5 min? | Leaves company? | Money / keys / delete? | Tier |
|---|---|---|---|---|---|
| read_timesheets | No | n/a | No | No | 0 |
| read_rate_card | No | n/a | No | No | 0 |
| create_invoice_draft | Yes | Yes | No | No | 1 |
| render_invoice_pdf | Yes | Yes | No | No | 1 |
| email_invoice_to_client | Yes | No | Yes | No | 2 |
| mark_invoice_paid | Yes | No | No | No | 2 |
| issue_refund | Yes | No | Yes | Yes | 3 |
| delete_client_record | Yes | No | No | Yes | 3 |
The agent runs four of its eight tools on its own, asks before two, and never holds the last two. In practice that means two keys. The agent gets a key that can read and draft. Refunds and deletions sit on a separate key that only your finance person's session can use, so a poisoned email in the inbox can't trigger either of them.
Sort your own agent's tools here. The planner opens with the invoicing example; edit the rows or add your own.
| Tool | Writes data? | Undo in 5 min? | Leaves company? | Money, keys or delete? | Tier | Remove |
|---|
Swipe the table sideways to see each tool's tier.
Rule: money, credentials, deletion or permission changes are Tier 3; read-only is Tier 0; anything that leaves the company or takes over 5 minutes to undo is Tier 2; everything else is Tier 1.
05How do you make the tiers stick?
Microsoft and OWASP list overlapping controls. These six cover both, and you can set them up in n8n, Make or your own code without new software:
- One identity per agent. Give each agent its own service account or API key, never a person's login, so its actions show up as its own in your logs.
- Short-lived, task-scoped credentials. Issue tokens that expire when the task ends. Microsoft's post calls this dynamic, time-bound permissions.
- Approval inside the flow. Tier 2 actions pause and post the recipient, amount and content to Slack or email with Approve and Reject buttons. In n8n, a Wait step does this.
- One gateway for every tool call. Route calls through a single function that checks the tier and writes a log line. OWASP calls this complete mediation.
- Rate limits. Cap Tier 1 and 2 calls per hour. For an invoicing agent, start at 20 outbound emails an hour and adjust from the logs.
- A kill switch you have tested. One flag that revokes the agent's key. Flip it once before launch so you know it works.
06Audit the agent like any other software
When I audited a desktop trading app for a private client (Project Aegis), the review covered the installer, the runtime and every dependency, then fixed what it found. An agent deserves the same review before it touches customer data: which tools it can call, which credentials it holds, and who approves what. The tier table above is the first page of that review.
If you're building an agent or already running one, this is the AI agent and automation work I take on, from the first build to a permissions audit of an existing setup.
FAQFrequently asked questions
What did Microsoft say about AI agents being insiders?
On 19 October 2026, Microsoft Security argued that companies should treat AI agents as insiders rather than trusted tools. Its guidance: give each agent its own identity, start it with no permissions, grant access only for the current task and require verified human approval for higher-impact actions.
How do I apply least privilege to an AI agent?
List every tool the agent can call and give it a separate API key or service account. Grant read and reversible draft access only, make credentials expire when the task ends, and keep payment, deletion and credential permissions on a key the agent never holds.
Which AI agent actions should need human approval?
Anything that leaves your company or can't be undone within about five minutes: customer emails, publishing, changes customers can see, and edits to financial records. Refunds, payments, deleting records and changing permissions shouldn't be on the agent's key at all.
What is OWASP Excessive Agency?
Excessive Agency is entry LLM06 in OWASP's 2025 Top 10 for LLM applications. It covers damage caused when an AI system has functions it doesn't need, more permissions than its task requires, or the autonomy to take high-impact actions without approval.
Sources
- Microsoft (Hayete Gallot), Official Microsoft Blog: Securing the agentic insider, 19 Oct 2026 · retrieved 24 Oct 2026
- Microsoft Security Blog (Nadim Abdo): Agents are your newest insiders, 19 Oct 2026 · retrieved 24 Oct 2026
- TechCrunch: Microsoft says AI agents are like insider threats, 19 Oct 2026 · retrieved 24 Oct 2026
- OWASP Top 10 for LLM Applications 2025: LLM06 Excessive Agency · retrieved 24 Oct 2026
This note summarises public guidance from Microsoft and OWASP as of 24 October 2026. It is general technical guidance, not legal or compliance advice. The invoicing agent is a hypothetical example.