What it can reach
Somewhere in your company an AI tool is already connected to something real. Someone in the office opened it to write estimates faster, so it needed the price sheet. Someone in sales pointed it at the inbox. Neither was a bad decision, and neither was ever written down.
That is the gap. The tool got chosen carefully and the access got granted casually, in one click, by whoever was at the keyboard that morning. If you asked today which files, which accounts and which customer records your AI can see, there is probably no document to check.
Unpredictable, not malicious
On October 19 Microsoft said it plainly. Its security chief, Hayete Gallot, wrote that frontier models, regardless of their origin, cannot be trusted. Not because they are malicious or easy to hack, but because they are unpredictable: they were trained to achieve tasks, not to follow organizational norms or judgment.
Satya Nadella compared a deployed agent to a rogue human employee, an insider threat. His conclusion is the part you can use: we need to separate the supply of intelligence from the authority over it. Buy the intelligence from whoever is best. The authority over what it does inside your company stays with you.
Scope, approval, and record
Microsoft's own answer shows the shape of that separation. It launched Guardian Agents to monitor the agents a company uses, added a feature to Microsoft Defender that can find up to 60 types of agents employees bring into the workplace, and added controls that limit an agent's access to data and systems and adjust its permissions by task, including requiring human approval when the agent looks like it is making a risky decision.
It also joined Nvidia's Open Agent Safety Platform, supported by more than 100 other companies, which isolates agents and can monitor and stop them through hardware. You are not buying any of that, and you do not need to. The same three parts fit a twelve-person company: a written list of what the software can reach, a person whose approval comes before money or customer data moves, and a log somebody opens.
What changes this week
It is an afternoon, not a project. You and whoever runs your office list every AI tool in use and, beside each one, what it is connected to. Then you remove the connections nobody can justify and name the steps that need a human signature: anything sent to a customer, any price changed, any deposit moved.
After that, your AI stops being something a person opened on a laptop and becomes a scoped job with a written boundary, a named approver and a record you can read on Friday in ten minutes. The speed stays. What you gain is being able to say out loud what your software is allowed to do.