From the source
Microsoft describes a layered safety architecture for AI agents that can take production actions, arguing that no single safeguard—model, prompt, or guardrail—is sufficient.
The post defines an agent as deterministic software wrapped around a non-deterministic model, and presents four boundaries (identity, tool, mutation, time) that together constrain agent behavior.
It emphasizes that authorization, not intelligence, is the hard part of safe autonomy.
