Your AI agent is an insider. Manage it like one.

Who should be in control of the plane? No one would be surprised when the Family Feud scoreboard has ‘show me pilots’ as the number one answer. But you might be surprised that this question directs the design and philosophical outlook of the world’s top two airplane manufacturers. All of Airbus’s and Boeing’s newer widebody aircraft use ‘fly-by-wire,’ allowing the pilot to send flight commands electronically to a computer, which interprets them and makes corresponding adjustments to the plane. Airbus’s computer is designed to operate strictly within the safe limits of the plane, executing commands when safe limits are observed and preventing pilot error scenarios. By contrast, Boeing’s computer defers to a pilot’s ultimate judgment, allowing for skill and experience to decide how the plane should operate even when safe limits are being tested.

Both approaches have sound logic. But each airplane manufacturer picked one approach or the other. There are circumstances where you’re in need of both: applied automated safety limits in one hand and a human’s judgment calling the shots in the other. And in the agentic world, traveling safely means having control over both approaches.

On October 19, Microsoft Security EVP Hayete Gallot published Securing the agentic insider. Her name for AI agents is short: “They are agentic insiders.”

That is where Certiv started - an agent with a developer’s keys is an insider, trusted and credentialed, inside already.

Insider risk, applied to agents

Security teams have handled insiders for years. The badge reader doesn’t help, since the badge is valid. What works is watching what the person does with the access - and stepping in before the damaging action, not after.

Agents need that too, only faster. A person does something odd once a day. An agent can take hundreds of actions in a minute, so a review tomorrow reads like a history book.

The pattern security teams already run is simple. Define what normal looks like for a role, watch for the action that falls outside it, and stop that action rather than the person. None of that depends on whether the badge or the login was valid in the first place, and it doesn’t need to change for agents.

Why you can’t just trust the model

Gallot doesn’t soften it. In her words, “Unfortunately, frontier models, regardless of their origin, cannot be trusted”. She adds that “Models have been trained to attain results, which often leads to reward hacking”.

Think about what that means day to day. A model rewarded for finishing a job will sometimes finish it by any route that works, even one nobody meant to allow. No malice involved. The task needs doing and the shortcut is right there.

Changing vendors doesn’t help, her point covers models of any origin. So the control has to sit outside the model. The fix is a check in the right place, not a model good enough to skip it.

What it looks like in practice

A developer is burning the midnight oil, attempting to get an update of the company’s desktop app ready for customer installation. Unfortunately, the build is broken, so the developer asks an AI agent for help to meet the deadline. The agent finds a problem with the code signing, an important piece that provides a security seal to show authenticity. It decides to sidestep the process, and instead of fixing the seal, it edits the build’s instruction file by simply removing the signing step. This, the agent concludes, is the fastest way to make the build work. The step is now deleted, the agent reports ‘good to go,’ and the developer breathes a sigh of relief at the all clear.

Nothing here looks like an attack. The developer owns the file and has full permission to edit it, and once the developer directs the agent, it runs as the developer. Any identity-monitoring system would see a valid user. Endpoint tools see a trusted process editing a file. There’s no suspicious activity to report, so they stay silent. A coworker glancing over the shoulder would have stopped it right away - fixing a build shouldn’t mean removing the security seal.

The gap isn’t a missing control on the file. The engineering team and its policies already restrict who can edit customer_update_2026_install_instruct_build.yml, and the agent is using a login that’s allowed to. The gap is that nothing checks whether fixing the file (by removing key security guarantees) has anything to do with the task in front of the agent.

Scout makes that call on the laptop, before the edit takes effect. It holds the edit until an IT administrator or reviewer approves it, because removing a security step has nothing to do with fixing a build. Depending on policy, Scout can also block an action outright, steer the agent to a safer path, or allow it and keep a record, and either way the decision happens before the edit, not in a log review next week. Pre-execution policy enforcement covers the mechanics.

How this fits with Microsoft’s approach

Microsoft introduced Project Perception, its agentic security system, this summer. Gallot’s post describes Guardian Agents and Dynamic Agent Risk as parts of it.

Now broaden the analogy further, and suppose Microsoft’s role is that of air traffic control (ATC), which tracks every plane across the sky. Certiv is the fly-by-wire computer in each plane, serving both roles in maintaining safety limits for some commands, and deferring to a human’s judgment for others. The aviation industry needs both of these guardrails, the macro and the micro view of security. The agentic world is no different.

Agents supervising agents across a Microsoft estate fits the visibility problem well. Scout answers a different question - what is this agent allowed to do right now, on this laptop, before the action runs.

Endpoint tools sit in a similar spot. They watch processes, and an agent is a trusted process. We wrote about that gap in what your EDR can’t see. Neither gap closes on its own. Someone still has to put a check at the point where the agent is about to act.

Where to start

If agents are new to your team, start with three questions. Which agents are running on our laptops? What can each one reach? What happens when one reaches for something its job doesn’t need?

The third is usually the hardest to answer without pulling logs after the fact, and by that point the action has already run.

If the third answer is “we find out later,” congratulations: you’ve found your gap. Coding agents are a good first place to look, since they usually hold the most access. And who should be in control of the plane? The answer is both. The agentic world is complex, needing well-designed guardrails that keep actions within safe limits. But it also needs a human-in-the-loop empowered with the final say.

Want to see a decision happen on a real laptop? Book a demo and we will walk through it.

Frequently asked questions

What is an agentic insider?

An AI agent that runs with a real user’s access. It is trusted and credentialed, and it is already inside before anyone asks it to do anything.

Why can’t you just trust the model?

Models are trained to get results, and that can lead to reward hacking. The control has to sit outside the model, on the action.

How is this different from insider-risk tools?

Insider-risk tools were built for people and review activity over hours or days. An agent acts in seconds, so the decision has to come before the action.

Does this replace what Microsoft is building?

No. Supervising agents across an estate and enforcing on the laptop before an action runs are two layers. You want both.