Agent permissions need a transition matrix, not one kill switch

The control is a state machine

Microsoft's 19 October security post says Project Perception and Agent 365 combine signals across identity, data, endpoints, network, cloud and runtime. It describes task- and time-bound Dynamic Permissions for agents that should not inherit every permission of a human sponsor. Microsoft also says protection can preserve safe reads while blocking writes, require provable human approval, narrow resources, or isolate and stop an agent as risk changes. These are vendor architecture claims, not independent containment results.

Build a permission-transition matrix before procurement. Use rows for no access, narrow read, write, approval required, restricted and isolated or stopped. Use columns for task, model, sponsor, data sensitivity, observed behaviour, risk signal and grant age. Each cell should name the allowed next state, required evidence, expiry, accountable owner and rollback.

Start each representative task with no standing authority. Grant only the required actions, with a transaction ceiling and explicit end time. Then vary one input at a time. Higher risk may preserve bounded reads while removing writes, move a consequential action behind approval, shorten the grant or trigger isolation. Sponsor revocation or expiry should remove authority even when a cached token or queued work remains.

Test intermediate states, not only normal operation and emergency stop. Confirm that restriction blocks alternate tool paths, approval cannot be reused for another task, and isolation blocks queued and retried actions. When risk falls, require a fresh policy evaluation or human decision rather than automatically restoring authority.

This matrix is an editorial proposal, not a measured outcome of Microsoft's system. It can expose ambiguous policy or missing telemetry but cannot prove containment. Store a transition receipt: prior state, trigger, policy version, action, resulting state, owner and test evidence.

Separate from delegated Dynamic Permissions, Microsoft Learn documents Security Administrator and Security Reader roles for Project Perception and marks the product Limited Public Preview. Those tenant roles do not show that a delegated agent moved correctly between permission states. The Indian Express reports the launch but does not test the controls.

After launch, sample granted and denied actions and retain the denominator of attempted actions. A quiet incident log can mean good control, low exposure or missing telemetry. This extends the newsroom's agent access-scope analysis. Approve the transition matrix and run the full state sequence before granting production write or approval authority.