October 20, 2026 — Microsoft has a useful new name for a real security problem: the “agentic insider.” An AI agent that can read company data, call tools and change live systems may not be malicious, but it can still create insider-sized damage if its goal is vague, its permissions are broad or its environment feeds it hostile instructions.
In an October 19 essay, Microsoft Security executive Hayete Gallot argues that enterprises should continuously supervise agents and adjust what they are allowed to do as risk changes. That direction is sensible. The controversial part comes later, when the essay says defenders will need greater transparency into the model itself, including its chain-of-thought, to judge whether its intent matches the task.
Chain-of-thought monitoring may become a useful alarm. It should not become the foundation of enterprise accountability. Businesses do not need to read an AI system’s mind before they can secure it. They need to control its identity, permissions, tools and irreversible actions.
Microsoft is right about the risk
The old security model assumed that software followed a defined path. An agent is different: it can choose a sequence of steps, gather new context, delegate work and adapt when the first plan fails. Give that system a shared administrator credential and the ability to act on untrusted content, and a minor instruction error can become a production incident.
Microsoft’s essay correctly emphasizes containment across identity, data, endpoints, networks, cloud services and runtime. It also argues for deterministic controls around nondeterministic intelligence. That is the strongest idea in the piece. Whatever an agent “believes” it is doing, the surrounding system should decide whether it may send the email, transfer the money, deploy the code or delete the account.
The same principle appears in a 2026 concept paper from the U.S. National Institute of Standards and Technology’s National Cybersecurity Center of Excellence. NIST frames the problem around identification, authentication, authorization, human-linked delegation and tamper-proof logs. Those controls are unglamorous, but they produce evidence that an auditor can verify.
A reasoning trace is a signal, not a receipt
A visible reasoning trace can expose warning signs. OpenAI says it already uses chain-of-thought monitoring to detect reward hacking and other misbehaviour in frontier models and internal agent deployments. The company’s April 2026 monitorability release is explicitly designed to measure whether that safety layer remains reliable as systems change.
That last phrase matters: safety layer, not source of truth. Anthropic’s research has found that stated reasoning can be unfaithful to the process that produced an answer, with behaviour varying by task and model. A polished explanation may omit the factor that actually drove a decision. A suspicious-looking trace can also precede a harmless action.
This makes chain-of-thought useful for triage and research, but weak as the record that decides blame, compliance or access. An organization should never have to prove what an agent was “thinking” before it can reconstruct what the agent opened, which credential it used, which policy allowed the action and who approved the delegation.
Build the audit trail around actions
A defensible agent deployment starts outside the model. At minimum, it should include:
- A dedicated identity for every agent. Do not hide autonomous activity behind a shared human or service account.
- Short-lived, narrowly scoped credentials. A research agent should not inherit publishing, billing or deletion rights simply because those tools exist.
- Approval gates for irreversible steps. Drafting and previewing can be automatic; sending, spending, publishing and deleting should cross an explicit boundary.
- Tamper-resistant action logs. Record tool calls, relevant inputs, outputs, policy decisions, errors and the human authorization chain.
- Sandboxing and recovery. Test plans in constrained environments and make consequential changes reversible wherever possible.
- Independent policy enforcement. The agent should not be able to rewrite the guardrail that determines whether its own request is allowed.
These controls remain valuable even when a model’s reasoning is hidden, incomplete or misleading. They also reduce the amount of sensitive information a company needs to retain. Reasoning traces can contain confidential prompts, customer data and internal assumptions; collecting them broadly creates another high-value archive that must itself be governed.
Accountability should survive better models
There is no conflict between researching chain-of-thought monitoring and building hard operational controls. The mistake would be treating the former as a shortcut around the latter. Models will change, traces may become less faithful, and vendors will expose different levels of internal telemetry. Identity, authorization and verifiable records must keep working through all of it.
The practical standard is simple: an organization should be able to explain an agent incident without pretending it can read the agent’s mind. Who asked for the work? What access was granted? Which action was attempted? What rule allowed it? Who could have stopped it? Can the change be reversed?
If those questions have solid answers, chain-of-thought monitoring can add another early-warning signal. If they do not, more access to hidden reasoning will not rescue the security model. The safest agent is not the one that narrates itself most convincingly. It is the one whose power is bounded, observable and accountable.
