Microsoft recommends data controls and system testing for government AI adoption

Microsoft's 2026 Digital Defense Report sets out recommendations for safer government adoption of AI. Its central argument is that security cannot be assessed at the model level alone: the data a model can reach, tools it can invoke, identities and permissions involved, and surrounding infrastructure must be evaluated together.

Access controls and memory protection

Microsoft recommends tracking both sanctioned tools and unapproved software, with access rules tied to data classification. Those restrictions should also cover prompts, query logs, agent memory, and generated text because each may contain confidential information.

Any agent operating across APIs or applications should have an auditable identity that records who built it, what it does, and which person is accountable for it. Permissions should remain narrow and short-lived, with renewed review whenever the agent's scope changes. The report also recommends credentials scoped to individual tool calls and measurement of how quickly access can be revoked after a compromise.

Keeping untrusted content out of trusted memory

Microsoft says its red-team work found that instructions embedded in external material, including email, could influence memory entries that were later retrieved as trusted context. Its proposed defence separates memory write paths so externally sourced data cannot directly modify instruction stores reserved for verified system rules.

The company also reports that agents may confuse stored user habits with direct instructions governing safety. In its internal testing, a simple human-confirmation screen was not always sufficient. For sensitive actions, Microsoft therefore recommends hard policy gates that stop execution until a reviewer can inspect both the proposed command and its raw operational context.

Shared security operations with organisational separation

The proposed model includes multi-tenant security operations centres where analysts and automated agents monitor several public bodies, while each agency retains its own cloud tenant, data-residency controls, and zero-trust boundary. Microsoft argues that pooled resources could reduce duplicated software costs and give smaller agencies access to specialist staff. However, the article notes that the report provides no evidence demonstrating actual cost savings across government agencies.

Within Microsoft's own security operations, agents gather alert context and draft threat summaries. The company says this workflow is used without human dispatch for 75 percent of its internal security incidents. Disruptive actions such as account lockouts still wait for administrator approval, while formal breach notifications remain under executive control. The 75 percent figure and operating experience are Microsoft-reported and were not independently verified in the article.

Continuous testing and accountability

The recommendations ultimately call for AI systems to be tested in the environment where they will operate, covering the interaction of models, tools, data, and users before and after deployment. Logging the inputs used for each action, the agent's confidence score, decisions taken, and notes from human reviewers is presented as essential for reconstructing incidents and assigning accountability.