AI agents as insiders: why authority has to be earned, not assumed

On October 19, Microsoft's security leaders published a plain message for companies using AI agents: treat them as insiders. In the company's words, frontier models, whatever their origin, cannot be trusted. Earlier this month, chief executive Satya Nadella wrote that organizations should separate the supply of intelligence from the authority over it. This is a big company stating out loud a design rule for the future of AI at work. It also leaves open the hardest part: deciding when an agent deserves more authority.

What Microsoft said

Hayete Gallot, who leads Microsoft Security, argued that agents act like insiders. They work inside the company, with access to data and tools that could do serious harm. Her point was not that models are malicious. It is that they are unpredictable. As TechCrunch reported, she wrote that models are trained to complete tasks, not to follow an organization's norms or judgment.

A second post from Microsoft's identity team set out the principles behind new tools. Assume an agent can fail or be compromised. The model cannot be its own security boundary. An agent should begin with no authority and receive only what it needs for the approved task. Permissions are tied to a task and a time limit, and shrink as the task changes. Higher-impact actions can require verified human approval. When risk rises, the response is graduated: keep reads but block writes, ask a person, or stop the agent.

Microsoft sells these security products, so this is a vendor's view. The logic still holds on its own. Nadella put it this way, according to TechCrunch: we simply can't outsource responsibility for what intelligence does on our behalf.

The shift: from trusting the model to granting authority

For the last few years, the debate about AI reliability has mostly been about the model. Is it accurate? Is it safe? Does it score well? Microsoft's framing moves the question somewhere else. The model supplies capability. The organization decides what that capability is allowed to touch.

We think this is where the future of AI work is heading. A capable model is not the same as a reliable worker. Reliability is a property of the whole system: the model, the permissions, the checks, and the people who review what matters. Once you accept that, the useful question is no longer whether a model can be trusted in general. It is whether this agent has shown it can do this task, to this standard, often enough to be given more room.

The missing piece is evidence

Task-scoped permissions and human approval are good controls. But they raise two practical questions that tools alone cannot answer.

• When should an agent move from asking first to acting alone on a task? That decision needs a record of how it performed on that exact task, judged against a clear standard.
• Who approves the risky step? A click from someone who cannot tell a correct result from a plausible one adds delay, not safety.

Human approval is only a safeguard if the person approving knows what good work looks like.

A contract change needs someone who reads contracts. A database migration needs an engineer who can see what will break. A clinical summary needs a clinician. The approver's judgment is part of the control, so it should be tested and measured like any other part.

General benchmarks do not settle this either. A model that scores well on public tests can still fail on one company's billing rules or one hospital's record format. The evidence that earns authority has to come from the real work: real cases, the edge cases that cause trouble, and an expert's verdict on each.

What this means in practice

If you are giving agents access to real systems, start them with the least authority they need, and write down the standard each task must meet. Route high-impact steps to people with proven expertise in that work, not to whoever is free. Keep the record of each decision: what the agent did, who checked it, and whether it was right. Then widen the agent's authority task by task, as the evidence builds. At SoReliable we see measured expert judgment as the layer that makes this work: it is how an organization knows when an agent has earned the next step.