An agent can lose its permissions and keep its influence

Microsoft expanded Project Perception. Agents now start with no standing access and get only what the task needs. As an agent’s risk score climbs, Conditional Access pulls rights back in steps: it can read but not write, recommend but not act, and at the top of the scale it stops. That solves access. What about influence? An agent with less access still picks which evidence to show, writes the summary, and recommends. The human reads what the agent prepared and signs. Take an expense agent flagged as risky. It loses the right to approve. If it can still recommend, in practice it still decides, because nobody reviews a recommendation the way they’d review raw receipts. A restricted mode that actually restricts gives the reviewer the receipts and the policy, with nothing from the agent on top. If the agent can’t be trusted to surface evidence either, stop it. So for every risk level, two questions, answered per feature and before launch: - What can the agent still contribute? - What does the human need in order to take the decision back? The risk score selects a mode you already designed. It doesn’t invent one at runtime. Reducing permissions is the half the platform gives you. What happens next is the half you still have to build.