Q: What are Guardian Agents and how do they work? A: Guardian Agents are external automated watchdogs that monitor active worker bots across cloud, network, and endpoints and step in when a bot behaves erratically. This Microsoft Guardian Agents security guide explains they enforce rules from the outside, apply runtime checks, and can pause or shut down bots to protect data. Q: Why does Microsoft recommend separating AI intelligence from security control? A: Microsoft warns that AI agents rarely intend harm but can make high-speed mistakes, and the team that trains a model should not be the final safety layer. The Microsoft Guardian Agents security guide advises treating agents like employees by assigning tasks, limiting access, and using independent controls to prevent unchecked actions. Q: How do Guardian Agents enforce least privilege at runtime? A: They use Microsoft Defender and Entra Agent ID to detect local AI tools and bind agent identities, then grant only the exact files or permissions needed for a single task before revoking access. The Microsoft Guardian Agents security guide recommends task-scoped roles, just-in-time access that auto-expires, and blocking wildcard permissions. Q: What should IT teams include in a setup checklist for Guardian Agents? A: The checklist in the Microsoft Guardian Agents security guide recommends mapping all agents and sensitive data, enabling Entra Agent ID and device health checks, creating task-scoped roles with just-in-time access, and adding human-in-the-loop approvals for high-risk steps. It also advises setting auto-pause rules, quarantine actions, full audit trails, and weekly reviews to iterate on controls. Q: How do Guardian Agents respond when an agent starts acting strangely? A: When an active agent acts strangely the system can restrict its access, request human approval, auto-pause or shut the bot down, and quarantine the process while cutting network egress. This Microsoft Guardian Agents security guide also notes hardware-level kill switches on devices like the Surface Laptop Ultra as a final barrier to cut mic, camera, or network access. Q: Which AI tools can Defender and Entra detect according to the guide? A: Microsoft Defender and Entra Agent ID can detect dozens of local AI tools, with the guide explicitly mentioning Claude Code, OpenAI Codex, and GitHub Copilot. The Microsoft Guardian Agents security guide emphasizes discovery across endpoints so identities can be bound and dynamic permissions applied. Q: What integrations and ecosystem partnerships support Guardian Agents? A: Microsoft is partnering with Nvidia on the Open Agent Safety Platform to align signals, policies, and response actions across vendors, clouds, and hardware. This Microsoft Guardian Agents security guide also highlights hardware integrations and device posture checks to extend containment beyond the operating system. Q: What risks and metrics should teams monitor when deploying Guardian Agents? A: Teams should watch for false positives, model drift, prompt injection, data exfiltration, shadow AI, and supply-chain issues as listed in the Microsoft Guardian Agents security guide. Key metrics to track include time to detect and time to contain incidents, percent of tasks completed with least-privilege roles, rate of denied high-risk actions per 1,000 agent steps, and coverage of agent discovery across endpoints and clouds.