Microsoft Publishes Agent Risk Controls That Shift Authorization Outside the Model
What happened
Microsoft published Reduce autonomous agentic AI risk on November 6, 2026, addressing three attack surfaces in autonomous agent deployments: agent-to-tool interactions, agent-to-service interactions, and agent-to-agent interactions. The guidance defines indirect prompt injection as the primary threat. Attackers embed hidden instructions inside documents, emails, or web pages that an agent reads, causing unauthorized actions. Microsoft's central requirement is that authorization and content filtering controls must be enforced by external infrastructure, not by the AI model itself. Models cannot be relied upon to reject malicious instructions they receive during a task. Organizations are told to separate instructions from retrieved data and tool outputs. All external content must be treated as untrusted regardless of source. Agents in multi-agent pipelines must not automatically inherit the permissions or trust level of the calling agent. The guidance directly reinforces Azure telemetry-confirmed findings that prompt injection is the leading agent attack vector in production deployments.
Why it matters
- ·Regulators and auditors increasingly treat vendor guidance from major platform providers as a de facto control baseline. Organizations that cannot show they have implemented external authorization controls for their agents face a documented gap against Microsoft's own published standard.
- ·The guidance makes clear that the enterprise deployer, not the AI vendor, is responsible for placing controls outside the model. This directly affects how compliance teams should draft vendor contracts, allocate internal accountability, and design oversight programs for agentic deployments.
- ·Multi-agent pipelines, where one AI agent calls another to complete a task, are explicitly called out as a trust boundary risk. Organizations that have not mapped their agent-to-agent interactions or reviewed how permissions flow between agents have an unmeasured exposure that this guidance now names.
Stay ahead of stories like this
Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your engineering or IT team to list every AI agent in production and confirm whether the content filtering and authorization controls for each agent are enforced by external infrastructure, such as a gateway or policy engine, rather than by the model's own instructions.
- ☐Review any multi-agent pipelines, where one AI agent calls another to complete a task, and confirm that each agent's permissions are explicitly granted for that task rather than automatically inherited from the calling agent.
- ☐Update your agentic AI vendor contracts to require that the vendor's architecture supports placing authorization controls outside the model, and document which party is contractually responsible for deploying those controls.
- ☐Conduct a tabletop exercise in which your team traces what happens if a malicious instruction is hidden inside a document or email that an agent reads during a workflow, and confirm your controls would catch and block it before the agent acts.
- ☐Compare your existing agentic AI controls against the three interaction categories Microsoft identifies (agent-to-tool, agent-to-service, agent-to-agent) and document any gaps for your next governance review cycle.
What to watch next
Organizations should monitor whether Microsoft follows this guidance with platform-enforced defaults in Azure AI Foundry or Copilot Studio that make external authorization controls the default rather than optional. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services covers similar ground on untrusted content. Regulators in the UK, EU, and US are likely to cite both documents when examining agentic deployments. As incident volumes from agent-to-agent attacks grow, documented adherence to published guidance from major platform providers will increasingly be the evidence bar that examiners and auditors set.