The Agent Has A Face. The Lie Is Worse

https://is1-ssl.mzstatic.com/image/thumb/Podcasts211/v4/8b/6a/a0/8b6aa0b5-d020-74cc-1766-3046253bc6d0/mza_2730532121990333816.jpg/600x600bb.jpg

M365.FM - Modern work, security, and productivity with Microsoft 365

Mirko Peters (Microsoft 365 consultant and trainer)

435 episodes

16 hours ago

Welcome to the M365.FM — your essential podcast for everything Microsoft 365, Azure, and beyond. Join us as we explore the latest developments across Power BI, Power Platform, Microsoft Teams, Viva, Fabric, Purview, Security, and the entire Microsoft ecosystem. Each episode delivers expert insights, real-world use cases, best practices, and interviews with industry leaders to help you stay ahead in the fast-moving world of cloud, collaboration, and data innovation. Whether you're an IT professional, business leader, developer, or data enthusiast, the M365.FM brings the knowledge, trends, and strategies you need to thrive in the modern digital workplace. Tune in, level up, and make the most of everything Microsoft has to offer. M365.FM is part of the M365-Show Network.

Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.

All content for M365.FM - Modern work, security, and productivity with Microsoft 365 is the property of Mirko Peters (Microsoft 365 consultant and trainer) and is served directly from their servers with no modification, redirects, or rehosting. The podcast is not affiliated with or endorsed by Podjoint in any way.

The Agent Has A Face. The Lie Is Worse

M365.FM - Modern work, security, and productivity with Microsoft 365

1 hour 5 minutes

1 week ago

The Agent Has A Face. The Lie Is Worse

(00:00:00) The Risks of AI Agents
(00:00:31) Microsoft's Efforts and Shortcomings
(00:01:18) The Timing of Control and Experience
(00:04:31) The SharePoint Deletion Incident
(00:06:19) Event-Driven Systems and Their Pitfalls
(00:08:07) Segregating Identities and Tools
(00:21:22) The Experienced Plane Tax
(00:25:20) Least Privilege and Segregation of Duties
(00:29:43) The Importance of Provenance and Policy Gates
(00:33:30) Anthropomorphic Trust Bias and Governance

Artificial intelligence is rapidly evolving from simple assistive tools into autonomous AI agents capable of acting on behalf of users. Unlike traditional AI systems that only generate responses, modern AI agents can take real actions such as accessing data, executing workflows, sending communications, and making operational decisions. This shift introduces new opportunities—but also significant risks. As AI agents become more powerful, organizations must rethink security, governance, permissions, and system architecture to ensure safe and responsible deployment. What Are AI Agents? AI agents are intelligent systems designed to:

Represent users or organizations
Make decisions independently
Perform actions across digital systems
Operate continuously and at scale

Because these agents can interact with real systems, their mistakes are no longer harmless. A single error can affect thousands of records, customers, or transactions in seconds. Understanding the “Blast Radius” of AI Systems The blast radius refers to the scale and impact of damage an AI agent can cause if it behaves incorrectly. Unlike humans, AI agents can:

Repeat the same mistake rapidly
Scale errors across systems instantly
Act without fatigue or hesitation

This makes controlling AI behavior a critical requirement for enterprise adoption. Experience Plane vs. Control Plane Architecture A central concept in safe AI deployment is separating systems into two layers: Experience Plane The experience plane includes:

Chat interfaces
Voice assistants
Avatars and user-facing AI experiences

This layer focuses on usability, speed, and innovation. Teams should be able to experiment and improve user interactions quickly. Control Plane The control plane governs:

What actions an AI agent can take
What data it can access
Where data is processed or stored
Which policies and regulations apply

The control plane enforces non-bypassable rules that keep AI agents safe, compliant, and predictable. Why Guardrails Are Essential for AI Agents AI guardrails are strict constraints that define the boundaries of agent behavior. These include:

Data access restrictions
Action and permission limits
Geographic data residency rules
Legal and regulatory compliance requirements

Without guardrails, AI agents can become unsafe, unaccountable, and impossible to audit. Permissions and Least-Privilege Access AI agents should follow the same—or stricter—access rules as human employees. Best practices include:

Least-privilege access by default
Role-based permissions
Context-aware authorization
Explicit approval for sensitive actions

Granting broad or unlimited access dramatically increases security and compliance risks. AI Governance, Auditing, and Compliance Strong AI governance ensures organizations can answer critical questions such as:

Who authorized the agent’s actions?
What data was accessed or modified?
When did the actions occur?
Why were those decisions made?

Effective governance requires:

Comprehensive logging
Auditable decision trails
Policy enforcement at the system level
Built-in compliance controls

Governance must be...