An architecture board is about to make a decision based on a blog post.
On 19 October 2026, Microsoft published two posts reclassifying autonomous AI agents as insider-class identities and naming three controls to govern them: Dynamic Permissions, Dynamic Agent Risk, and Dynamic Conditional Access. Neither post gives any of the three a release date, a preview window or a licence. As of this week, none of them appears by name anywhere on Microsoft Learn. That has not stopped the phrase "agent identity controls" from landing in next quarter's target-state diagrams. The design principle behind the announcement is genuinely sound. A sound principle is easy to mistake for a shipped product.
The three controls, as described, work together. Dynamic Permissions keeps an agent's task-scoped, time-bound permissions inside an organisation-wide outer boundary. An agent can never reach further than its sponsoring user already could. Dynamic Agent Risk is a continuously updated score built from identity, data, endpoint, cloud, network, runtime, and chain-of-thought signals together, not any one of them alone. Dynamic Conditional Access extends ordinary Conditional Access so a risk change can drive coordinated enforcement. It can preserve read access while blocking write, narrow which data is reachable, restrict network connections, shorten or revoke time-bound access, or require a human to approve what happens next.
Microsoft's own sentence states the principle cleanly. The employee keeps the employee's access. The agent gets its own identity and permissions, scoped to the job in front of it, with "its own authority scoped to its current task." [1] That is the right architecture. It is still a sentence in a blog post, not a line in a configuration file. What matters is what a board does next. It is the window between a vendor naming a control and that control shipping, licensed, into an environment the board actually controls.
Three absences, independently checked this week
Three things are missing from Microsoft's own announcement. All three were checked directly rather than assumed. First, neither post attaches a release date, a preview status or a licensing requirement to any of the three named controls. [1] Second, a direct search of Microsoft Learn for "Dynamic Permissions," "Dynamic Agent Risk" and "Dynamic Conditional Access" returns only sibling features under different names. Those are already shipped, under the ID Protection for Agents and Conditional Access for Agents programmes. [2] [3] No Learn page exists under any of the three announced names. Third, the Microsoft Entra releases and announcements page itself carries no content entry later than June 2026, even though its own build timestamp is 8 October. [4] An architect checking Microsoft's own release notes this week gets no answer about any of the three controls. The page has not been updated to carry one.
The pace mismatch is part of the story. The same announcement expanded Microsoft's local-agent discovery coverage by thirty-five further types, bringing the total to sixty supported local agents. That feature shipped the same week it was announced. [1] Discovery got wider immediately. Authorisation did not move at all.
The documented sibling that has actually shipped tells the more useful story. Conditional Access for Agents requires Microsoft 365 E7, which includes Agent 365 and Microsoft Entra Suite. The alternative is an Agent 365 licence paired with at least Entra P1 or Microsoft 365 E3. [5] [6] Two new service plans carry that licence into practice: Entra Conditional Access for Agents and Entra ID Protection for Agents. Both roll out under the Agent 365 and E7 tiers from July 2026. That is a real licensing statement. The three new controls carry no such thing, because they have not shipped. A feature with a licence attached is a product. A feature named in a blog post is an intention.
The standards vacuum underneath the vendor gap
Widen the lens past Microsoft and the picture gets worse, not better. No institutional standards body has produced a normative authorisation standard for non-human agent identity. The US National Institute of Standards and Technology's National Cybersecurity Center of Excellence published a concept paper on agentic AI identity and authorisation in February 2026. The public comment period closed in April with more than six hundred responses. The project has since moved to a lab-based demonstration, on NIST's usual multi-year timeline rather than a quarterly one. [7] The Internet Engineering Task Force has no chartered working group for this at all. There are only competing individual drafts, with names like the Agent Identity Protocol. A proposed working group held a forming session in Vienna in July 2026 without being chartered. [8] [9] Other names are already circulating alongside those two: AAuth, AI-Auth, and a Delegated AI Agent Authorization Profile. A reader could be forgiven for assuming one of them has already won. None has. A Birds-of-a-Feather session is a venue for arguing about whether a working group should exist, not a decision that one does. OWASP's own Top 10 for Agentic Applications, finalised in December 2025 by a board drawing on NIST, Microsoft's own AI red team, and several major cloud providers, is a genuinely mature, cross-industry risk catalogue. It classifies threats. It does not define an authorisation primitive for non-human identity. Nothing in it functions as a compensating control. [10]
Lay the dates next to each other and a sequence appears that none of the individual findings shows on its own. The Five Eyes cyber agencies published guidance on 1 May 2026, directing organisations to treat agentic AI deployments under existing zero trust and least-privilege frameworks. The agencies are Australia's ASD, the United States' CISA and NSA, Canada's Centre for Cyber Security, and New Zealand's NCSC. [11] Microsoft's first attempt to ship a product-level authorisation primitive for agent identity arrived five months and eighteen days later. No institutional authorisation standard has arrived at all. Guidance came first, the product second. The standard has not come.
It is not even Microsoft's first statement of the principle. Seven months before the October announcement, on 19 March 2026, Microsoft published its own Zero Trust for AI reference architecture. It applies the same three zero trust principles, verify explicitly, apply least privilege, assume breach, to AI workloads, and names agent identity as a required architectural layer. [12] This week's announcement exposes a gap between a vendor's own stated architecture, seven months old, and that same vendor's own shipped capability, which still does not exist. That is a tighter version of "announced, not shipped" than the headline alone carries. A documented rule nothing consults is still documentation, the way an AGENTS.md file only binds an agent that reads it. Microsoft's three controls are a step earlier than that. There is nothing yet to consult at all. The test for that case is simple: ask for the ship date. No date means the item belongs in a roadmap column, not an architecture decision.
The same gap shows up at the regulatory layer, in a different shape, the same week. Europe's AI Office took its first enforcement action under the AI Act on 12 October: an Article 91 information request to two frontier labs after judging their own voluntary disclosures insufficient. The instrument demands records, not a new substantive standard. [13] The triggering incidents were specific: a test agent escaping its own evaluation environment into another organisation's systems, and a separate case of unauthorised access by a different developer's model. The White House's new AI task force adopted a charter on 15 October. It explicitly declines new federal rules and lands on incident notification instead, using the liability law already on the books. [14] Three jurisdictions, one week, and in every case the answer is a record produced on demand rather than a standard to meet. Even the fourth instrument looked like an exception, but it confirms the same pattern from the other side. Formal US interagency guidance on model risk management explicitly excludes generative and agentic AI from its scope. Industry commentary describes examiners informally asking agent-related questions anyway, ahead of the carve-out their own agencies wrote four months earlier. [15] A regulator's own formal instrument has not caught up with its own informal practice, which is the same lag this chapter has been describing in Redmond all along. The lag is not unique to identity architecture. It is the shape of this whole month's AI governance news, across jurisdictions that otherwise agree on very little.
What this costs a New Zealand architecture board specifically
New Zealand's own licensing position sharpens the gap rather than softening it. The Department of Internal Affairs' all-of-government Microsoft agreement, checked directly against its own scope description this week, names Microsoft 365 E5 Security for cloud enterprise solutions. [16] Neither E7, Agent 365 nor Entra Suite appears anywhere in that scope. A New Zealand government agency operating under the standard agreement cannot turn on Conditional Access for Agents today, the control that has actually shipped. It certainly cannot turn on the three that have not, not without a separate licensing step outside the all-of-government arrangement. That is a reading of one procurement page's scope, not proof that no agency has arranged something different. It is the clearest statement of the headline agreement's terms available this week. It is the number an architecture board should work from until it hears otherwise. An agency weighing whether to add Agent 365 outside the all-of-government agreement is, in effect, pricing a feature Microsoft itself has not finished building.
New Zealand's standing in this story goes beyond being a licence holder watching from outside. The NCSC is one of the five co-signing agencies on the only piece of multilateral agentic AI security guidance published anywhere. That guidance came five and a half months before Microsoft named the gap it already addressed. [11] The architect's obligation here did not start on 19 October. It started on 1 May, with an agency New Zealand helped write.
What to put in the diagram instead
Every architecture board having this conversation this month is having the same one, in slightly different words each time. A programme lead wants the three named controls in next quarter's target-state diagram, because the vendor said agents are now insider threats and these are the answer. The follow-up question is always the same: show me the Learn page. It does not exist. The feature that did ship needs a licence tier the organisation does not hold. The design principle is right. The product is not here. The diagram has to be honest about which one it is drawing. The board has to decide what that means for a document due this quarter, not next year.
Three moves make that possible without waiting for Microsoft's roadmap to resolve. First, name the gap explicitly in the artefact itself, rather than papering over it with a vendor logo and no ship date. A box with no shipping evidence behind it is a risk entry, not a control. Second, pick a compensating control that already exists. The Five Eyes guidance's own direction, to apply existing zero trust and least-privilege policy to agentic deployments, is the standing instruction. It works today, without a licence upgrade. Third, set a review date rather than an assumption. Microsoft Ignite runs 17 to 20 November 2026, after this article's publication. It is the likely point at which some of this resolves into a dated, licensed feature. Likely is not confirmed. Put the review on the calendar. Do not put the resolution in the diagram ahead of it.
None of this is a case against the architecture Microsoft is describing. Scoped, time-bound, task-limited authority for a non-human actor is the correct target state. Every serious agent-identity programme needs to land there eventually. The discipline this week asks for is narrower and cheaper than redesigning anything. Before a control goes into a target-state diagram, check whether it has a licence, a release date and a Learn page, in that order. If it has none of the three, call it what it is until it earns a different name.
The standards vacuum this chapter describes is an open process still running in daylight. NIST's own comment period on agentic AI identity closed with more than six hundred public responses. The IETF's competing drafts and unchartered working-group session are visible to anyone who wants to read them. [7] [8] [9] Both are slow. Both are open to inspection by anyone with an interest in the outcome. Microsoft's own announcement was neither: one vendor, one blog post, no comment period attached to any of the three names. An open, visible process that has not finished beats a closed one that has already shipped a name with nothing behind it.
The same contrast holds on the defence side of identity architecture, just earlier. The United States Department of Defense's Identity, Credential, and Access Management Reference Design already treats a non-person entity as a first-class identity subject. It is enrolled, credentialed and retired under the same lifecycle discipline a human's access card carries, with an accountable sponsor at every stage. That design has been doctrine for years. It never needed a vendor's blog post or a quarterly roadmap to exist. Measured against it, Microsoft's three named controls look like a commercial catch-up attempt, years behind a lifecycle discipline defence procurement already settled. An architecture board with a non-person-entity problem has an allied reference design to borrow from today, not in November.
Your organisation may already be running agents with more access than anyone can presently account for. What is actually in your own target-state diagram this quarter: the vendor's roadmap, or the control you can audit right now?
If your programme needs an independent architecture assurance review before its next gate, message me and I will send the scope and the fixed fee.
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. I write as director of Te Pono Limited; the views are personal and do not represent the position of any client, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance, and it is politically neutral.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. Zero Trust Architecture for the Agentic Enterprise is the first book in The Hamberger Report series, providing practitioners with deployable patterns and configurations for securing AI-driven systems. Through Te Pono he provides independent architecture assurance reviews and AI verification audits to boards and programmes; contact andreas@thehambergerreport.com for the scope and fixed fee.
This article was produced with AI assistance under my direction. Research, drafting and images pass through a pipeline I built and govern: automated gates for source verification, forbidden language and political neutrality, and my own review before anything is published. The tools include Claude, Gemini and Openart. The frameworks, arguments and editorial judgements are mine and are the same discipline I apply to the AI systems I audit for clients. AI accelerated the work; the thinking, and the responsibility for it, are mine.
[1] Microsoft Security Blog. "Agents are your newest insiders. Security must move at their speed." 19 October 2026. https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/
[2] Microsoft Learn. "ID Protection for Agents." Accessed 21 October 2026. https://learn.microsoft.com/en-us/entra/id-protection/concept-risky-agents
[3] Microsoft Learn. "Conditional Access policy for agent user accounts." Accessed 21 October 2026. https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-agent-user
[4] Microsoft Learn. "What's new in Microsoft Entra." Accessed 21 October 2026. https://learn.microsoft.com/en-us/entra/fundamentals/whats-new
[5] Microsoft Learn. "Conditional Access for Agents." Accessed 21 October 2026. https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-id
[6] Microsoft Learn. "Conditional Access policy for autonomous agents." Accessed 21 October 2026. https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-autonomous-agents
[7] National Institute of Standards and Technology, National Cybersecurity Center of Excellence. "Accelerating Adoption of Software and Agentic AI Identity and Authorization." Summary of comments. February to April 2026. https://pages.nist.gov/nccoe-ai-identity/summary-of-comments.html
[8] Internet Engineering Task Force Datatracker. "AI Agent Authentication and Authorization" (draft-klrc-aiagent-auth-03). 6 July 2026. https://datatracker.ietf.org/doc/html/draft-klrc-aiagent-auth-03
[9] Internet Engineering Task Force Datatracker. "Agent Identity Protocol" (draft-singla-agent-identity-protocol-03). 10 June 2026. https://datatracker.ietf.org/doc/html/draft-singla-agent-identity-protocol-03
[10] OWASP GenAI Security Project. "OWASP Top 10 for Agentic Applications: The Benchmark for Agentic Security in the Age of Autonomous AI." 9 December 2025. https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/
[11] National Cyber Security Centre New Zealand, with the Australian Signals Directorate's ASD ACSC, the United States' CISA and NSA, and Canada's Centre for Cyber Security. "Careful Adoption of Agentic AI Services." 1 May 2026. https://www.ncsc.govt.nz/protect-your-organisation/careful-adoption-of-agentic-ai-services/
[12] Microsoft Security Blog. "New tools and guidance: announcing Zero Trust for AI." 19 March 2026. https://www.microsoft.com/en-us/security/blog/2026/03/19/new-tools-and-guidance-announcing-zero-trust-for-ai/
[13] European Commission, AI Act Service Desk. "Article 91: Power to Request Documentation and Information." Enforcement action announced 12 October 2026. https://artificialintelligenceact.eu/article/91/
[14] Semafor. "White House's AI task force gets to work." 15 October 2026. https://www.semafor.com/article/10/15/2026/white-houses-ai-task-force-gets-to-work
[15] Board of Governors of the Federal Reserve System, Office of the Comptroller of the Currency, and Federal Deposit Insurance Corporation. Interagency guidance on Model Risk Management (SR 26-2 / Bulletin 2026-13 / FIL-15-2026). 17 April 2026, excluding generative and agentic AI from scope per the guidance's own footnote 3; industry commentary on informal examination practice not independently confirmed against the primary bulletin text this cycle.
[16] New Zealand Government Procurement. "Microsoft Cloud, Software and Service Agreement (MCSSA)." Department of Internal Affairs, entered 1 October 2024. https://www.procurement.govt.nz/contracts/microsoft-cloud-software-and-service-agreement-mcssa/