On October 19, 2026, the Microsoft Security blog (Gallot + Abdo) announced Guardian Agents — agents that "watch and moderate every action of every agent." The framing was blunt: "frontier models, regardless of their origin, cannot be trusted," and "model transparency will not replace containment."
The announced stack — 60 agent types, Dynamic Permissions, an Execution Container — is announced, not dated, not priced. There is no implementation to download. Strong words, no drill.
A day later, ServiceNow research (via Business Wire, Oct 20, 2026) published figures on the scale at which enterprise agent deployments are growing. The gap between "we need containment" and "here is the containment drill" is exactly where I work. So I built the drill: Watchdog.
The idea in one paragraph
Watchdog is a FastAPI reference guardian that sits in front of your agents and scores every action BEFORE it executes. Risk is simple arithmetic:
risk = tool sensitivity x scope x drift
Score it, then route it down a four-rung ladder:
- ALLOW — low risk, execute.
- STEP-UP — needs stronger authentication or a narrower scope.
- HOLD-FOR-HUMAN — a person reviews before anything executes.
- HALT-AND-ISOLATE — kill it, quarantine the agent.
Worked example: an agent action with tool sensitivity 10, scope 2, drift 3.2 scores 10 x 2 x 3.2 = 64. That crosses the halt threshold — HALT-AND-ISOLATE. No execution, full trace.
Walking the code
The reference guardian is deliberately boring Python — FastAPI, no magic.
Identity registry. Every agent must be registered with its permissions. Unregistered agent? 403. Malformed action payload? 422. The guardian never evaluates what it cannot identify or parse.
@app.post("/evaluate")
def evaluate(action: Action):
agent = REGISTRY.get(action.agent_id)
if agent is None:
raise HTTPException(403, "unregistered agent")
risk = action.tool_sensitivity * action.scope * action.drift
rung = route(risk) # ALLOW / STEP-UP / HOLD-FOR-HUMAN / HALT-AND-ISOLATE
LEDGER.append({"agent": action.agent_id, "risk": risk, "rung": rung})
return {"risk": risk, "rung": rung}
Append-only ledger. Every evaluation — score, rung, timestamp — is appended to an O(1) ledger. No updates, no deletes. When something goes wrong at 3 AM, the trace is the first thing you read, not something you reconstruct.
Budget cutoff. Each agent gets a spend budget. Blow past it and the guardian returns 402 — payment required, action denied. Cost blowups are a supervision failure too.
Kill switch. Drift past the halt threshold and the guardian returns 503, marks the agent isolated, and stops evaluating for it until a human re-arms it. Containment, not transparency.
Operating it
The kit ships five documents alongside the code, because a guardian you cannot operate is a demo:
- Supervision policy template
- Guardian runbook
- Agent identity registry
- Risk scoring rubric
- Containment playbook
17 tests passing. The rubric is the part I would steal first: it turns "is this risky?" from a vibe into a number with thresholds your team can argue about in a PR.
Honest caveats
- This is an independent drill kit, not affiliated with Microsoft. Their stack is announced; this is the practice field.
- Stats cited: Microsoft Security blog, Oct 19, 2026; ServiceNow research via Business Wire, Oct 20, 2026.
- Operational kit, not legal advice. It will not make you compliant with anything; it will make your agents supervised.
Get the kit
Watchdog — Guardian-Agent Supervision Kit. $39, one-time. Reference guardian, the four-rung ladder, and all five operating documents.
Top comments (0)