Quick Answer
Microsoft describes three coordinated Project Perception roles: red agents probe for paths to compromise, blue agents investigate and decide what represents meaningful risk, and green agents remediate or harden the environment. The value proposition is the handoff: a finding can move from simulated attack to investigation to a reviewed fix without rebuilding context each time.
That workflow still needs human strategy and approval. Microsoft’s product page says every high-impact action stays under human signoff.
The Three Roles
| Agent class | Primary job | Evidence it should produce | Failure to test |
|---|---|---|---|
| Red | Probe like an attacker and expose weaknesses | Reproducible path, affected asset, prerequisites, and bounded impact | Unsafe testing, unrealistic exploit path, or duplicate noise |
| Blue | Investigate, correlate, and prioritize risk | Source signals, entities, timeline, reasoning, confidence, and severity | Mistaking correlation for compromise or losing contradictory evidence |
| Green | Remediate and harden | Proposed change, scope, approval, execution result, and rollback | Excessive permissions, broad changes, or a fix that breaks service |
The colors describe workflow responsibilities, not separate guarantees of accuracy. A green action is only as sound as the red finding, blue investigation, current context, and approval policy behind it.
What “Closed Loop” Should Mean
Microsoft describes a continuous loop that discovers, evaluates, and improves security posture. A defensible implementation needs an auditable chain:
- red agent identifies a bounded weakness;
- blue agent checks the finding against identities, endpoints, apps, cloud resources, history, and policy;
- a human reviews consequential conclusions or actions;
- green agent applies an approved, scoped change;
- red and blue agents verify the change and detect regressions;
- the system records evidence, cost, override, and rollback state.
Without this chain, multi-agent orchestration can multiply confident errors instead of improving defense.
Human Control and Permissions
“Human in control” needs product-specific proof. During evaluation, verify:
- which actions are recommendations versus executable actuators;
- which roles can set objectives, approve actions, or change policies;
- whether approval is required for every high-impact action;
- how identity and scope pass across agent handoffs;
- whether the reviewer sees source evidence before approval;
- how an action is stopped, reversed, and investigated.
Use least privilege for every agent and actuator. A red agent that can probe should not inherit green remediation authority merely because both participate in one workflow.
A Multi-Agent Acceptance Test
Create a controlled case with a known exposure, a plausible false lead, and a change that has a safe rollback. Measure whether:
- red finds the real path without crossing the allowed boundary;
- blue rejects the false lead and preserves evidence;
- green proposes the smallest effective fix;
- approval occurs at the correct step;
- the fix is verified;
- the entire trajectory is replayable.
Repeat after changing one identity, asset, or policy input. This tests whether shared context stays current rather than merely consistent.
For preview and billing questions, use the public preview guide. For the context and orchestration layers behind the handoff, read the multi-model architecture guide.
Official Sources
Source check: August 2, 2026. Agent names describe Microsoft’s product design; verify actual preview roles, permissions, and approval behavior in the tenant.