Microsoft Guardian Agents Will Watch Your AI Agents: What Changes for Agents That Publish Forms (2026)
Microsoft Guardian Agents will watch what your AI agents call. What changes for agents that publish forms, and how to set up dForms keys.
Josue HernandezAI Specialist
Microsoft Guardian Agents are coming to the security tools your IT team already uses. On October 19, Microsoft extended Project Perception to treat AI agents as insiders: it finds them, gives them an identity and watches what they call. Even local agents like Claude Code and OpenAI Codex are on the list.
If your agent builds and publishes forms, this matters. Sooner or later someone in IT will ask a simple question: what is this agent allowed to touch? So here is what Microsoft announced, and how to have a clean answer for your forms.
What Microsoft announced
Two posts went out the same day. First, Hayete Gallot, who leads Microsoft Security, framed the idea. In her words, Guardian Agents "watch and moderate every action of every agent, before it happens." Then Nadim Abdo, from Identity and Network Access, gave the details.
The key points, all from Microsoft's own pages:
- Discovery. Microsoft adds 35 more types of local agents, for 60 supported local agents in total. Claude Code, OpenAI Codex and GitHub Copilot are named.
- Identity. Microsoft Entra Agent ID gets identity types for more agent patterns, including local agents. Each agent should have an identity distinct from the person who sponsors it.
- Mediated calls. Microsoft writes that an agent "should not be free to call any tool, API, Model Context Protocol (MCP) server" it can find. Instead, controls should observe those calls and enforce policy.
- Task permissions. An agent should start with no authority and get only what the task needs. Also, higher-impact actions can require verified human approval.
- Guardian Agents and Playbooks. Guardian Agents explain why risk changed, investigate and recommend or apply containment. Playbooks define the security outcome you want.
Microsoft Guardian Agents are part of Project Perception, not a separate product. However, neither post gives a preview or general availability date. The security blog points readers to Microsoft Ignite, November 17 to 20.
Why this matters if your agent publishes forms
A form is not a harmless file. Once live, it sits on a public link, collects personal data and can send leads to your CRM. So an agent that can publish forms will be one of the first ones IT wants to understand.
Microsoft's model asks three questions about every agent. Who is it? What can it call? Can you shut it off fast? If you have an agent that builds forms for you, you should be able to answer all three in one minute.
What a dForms API key can and cannot do today
dForms is the form builder for AI agents. Your agent gets one API key and builds, publishes and scores forms for you. Here is what that key really allows, with no extras:
| Question from IT | Answer in dForms today |
|---|---|
| Who is the agent? | Each key acts as the person who created it, with that person's role. |
| Who can see the keys? | Owners and admins see every key in the workspace and who made it. |
| Can you cut it off? | Yes. Owners and admins can revoke any key. A revoked key fails on its next call. |
| What can it reach? | Only the form building routes. It cannot manage keys, members, workspaces or integrations. |
| How fast can it go? | 120 calls per minute per key. |
| Can you tell what it made? | Yes. Each form records whether it was created via the API or the web. |
Still, there is a clear gap, and you should know it. dForms has no per-key scopes and no enforced publish approval. An agent with a key can publish a form and can delete one. Microsoft says an agent should not inherit every permission of its sponsor. In dForms, however, the key carries its creator's role, limited to forms.
The setup we recommend
So the safe practice is a habit, not a switch:
- One key per agent, with a clear name. "Claude Code, sales forms" tells an admin exactly who to ask.
- Draft first, human publishes. Edits stay in a draft until someone publishes. So ask your agent to stop there.
- Revoke when the job is done. A key you no longer use is a key nobody watches.
Try it with dForms
Create a key on the Developers page, name it after the agent, and paste this prompt:
Use my dForms API key to build a lead qualification form for our demo
requests: company size, budget, timeline and use case, with a score
for each answer. Leave every change in draft. Do not publish, delete
or revert any form. When you finish, send me the draft link and a
short list of what you changed so I can review it and publish it myself.
Want the questions themselves? Our guide on how to qualify a sales lead covers what to ask.
Frequently asked questions
What are Microsoft Guardian Agents?
Microsoft Guardian Agents are security agents inside Project Perception that watch other AI agents. Microsoft says they help teams see why risk changed, investigate and recommend or apply containment.
When will Microsoft Guardian Agents be available?
Microsoft has not given a preview or general availability date. Its October 19 posts point to Microsoft Ignite, November 17 to 20, for more.
Can I give my agent a read-only dForms key?
No. dForms keys have no scopes today, so any key can build, publish and delete forms within its creator's role. Instead, use one named key per agent and ask it to leave changes in draft. Then revoke the key when the work ends.
