What is Synthagent? The guard agent that protects your AI agents' four control layers

Synthwatch and Synthagent are in early access. This post explains what they do today and what is coming.

Your teams are building Copilot agents in Copilot Studio and Agent Builder. Developers are trying Microsoft Foundry. Google Workspace customers are switching on Gemini agents that get their own accounts. And the SaaS tools you already pay for keep adding agents of their own.

Most businesses can now answer the first question about their agents: which ones do we have? Very few can answer the next four. Who owns each agent? How does it sign in? What has it been allowed to reach? And who is it talking to?

Synthagent is the guard agent inside Centeye Synthwatch, built to answer those questions all the time, not once a quarter. This post explains what it is, the four control layers it protects, and how it works alongside the tools you already have.

Synthwatch and Synthagent in one paragraph

Centeye Synthwatch gives every AI agent an identity, an owner and an off switch, across Microsoft 365, Google Workspace and the apps they connect to. Synthagent is the guard agent inside Synthwatch. It watches every agent, all the time, through the four layers every agent needs in order to act at all. When something changes, it detects it, links it to the people and data around it, and gives you the fix in the same place, so nobody has to trace the problem back by hand.

Why “discovered” isn’t the same as “secured”

Discovery tools give you a list. A list doesn’t tell you:

• that the HR agent still runs on the account of the person who built it, and she left in June;
• that the sales agent’s key was copied into a script on a developer’s laptop;
• that a note-taker your finance lead approved can read every mailbox he can;
• that the scheduling app connected last spring now passes data to two other apps.

Each of those is a different control layer. Each needs watching on its own, and each needs joining to the others to make sense.

The four control layers Synthagent protects

1. Agent identities: who is this agent?

Every agent should have its own identity, tied to a named human sponsor, with a review date. Synthagent checks:

• Agents with no identity of their own, such as those running on a shared or admin account.
• Agents with no sponsor, or a sponsor who has left the business.
• Agents past their review date, so nothing stays approved forever.

2. Agent authentication: how does it sign in?

An agent proves who it is with keys, tokens and sessions. They are the easiest thing to steal, and the least watched. Synthagent looks for:

• Keys and tokens in use from somewhere new, or at hours the agent never works.
• Old keys from finished projects that still work.
• Trouble with the sponsor’s own sign-in, such as a takeover. If Centeye Gatewatch finds the sponsor’s account was taken over, every agent that person owns is reviewed in the same case.

The fixes: reset the API token, revoke the sessions, or lock the service account.

3. Agent grants: what is it allowed to reach?

Most agent incidents aren’t clever attacks. They’re agents doing what they were allowed to do, with far more access than the job needs. Synthagent reads every grant:

• What each app grant (OAuth grant) allows, with a risk score.
• Write access where read would do.
• Oversharing an agent can surface, such as a payroll folder shared with everyone, which any assistant can then put in front of anyone who asks.

The fix: revoke one specific grant, or narrow the sharing, at the setting you choose. Every revoke can be undone.

4. Agent connections: who is it talking to?

Agents call other apps, and those apps call others. Access spreads further than anyone planned. Synthagent follows:

• App-to-app chains, when one connected app uses its access to reach the next.
• New connections, when an agent starts calling an app or system it has never used.

The fix: cut the grant between two apps before the chain reaches customer data. Seeing agents and MCP servers that run on laptops is coming next.

How Synthagent works, step by step

1. It knows every agent. Synthwatch lists the agents and AI apps holding access to Microsoft 365 and Google Workspace as they appear. AI apps people connect themselves, found by Centeye Lumen, are handed over with their owner.
2. It learns each agent’s normal. How much it usually reads, which apps it calls, and when it works. An invoice agent’s normal looks nothing like a support agent’s.
3. It watches all four layers at once. A volume jump on its own is a question. A volume jump from a key used somewhere new, on an agent whose sponsor just had an odd sign-in, is an answer.
4. It links everything in one case. The agent, its sponsor, the sponsor’s device and mailbox, and the data the agent touched. It can also ask the sponsor why: “Your invoice agent just read 1,200 files. Was that expected?”
5. It fixes in place, at your setting. Recommend only, ask first, or automatic, chosen action by action. Protective steps, like revoking one agent’s grant, can run on their own. Disruptive steps always wait for a person.
6. It checks and records. Every action is checked afterwards at Microsoft or Google, and recorded: who, what, why and when.

It works inside the ecosystem you already have

Synthagent doesn’t ask you to rebuild your agents or move them onto a new platform. It works from outside the agent, through the same identity, access and grant controls in Microsoft 365, Microsoft Entra ID and Google Workspace that MSPs already manage for people.

That has three benefits:

• It works whoever built the agent: Copilot Studio, a SaaS vendor, a developer, or someone in finance with two clicks.
• It can’t be talked out of it. An agent can be tricked by a clever prompt. Revoking its grant stops it whatever it was told.
• It sits alongside Microsoft’s and Google’s own controls. Use those. Synthagent adds one view across both, and across every client for an MSP. Read is Microsoft Agent 365 enough? for how the two fit together.

A worked example: the HR agent nobody owned

This is an illustrative example, not a real client. A 70-person firm’s HR coordinator built an agent in Copilot Studio to answer staff questions about leave. She left in June. The agent kept running.

Tuesday, 2:10 am. The agent starts reading files in an HR folder it has never touched: disciplinary notes and salary reviews.

What Synthagent sees, layer by layer:

1. Identity: the agent’s sponsor left four months ago. Nobody owns it.
2. Authentication: the agent’s connection is being used from an address the firm has never seen.
3. Grants: the agent can read the whole HR share, because the share was opened to the HR group years ago, and the agent inherited that access.
4. Connections: it has started passing results to a file-sharing app connected the week before.

Synthagent opens one case with all four, revokes the agent’s grant and the new file-sharing app’s access, resets the connection’s credentials, and lists every file the agent opened. The MSP wakes up to a one-page summary and one decision: who should own this agent now, or should it be retired?

Checklist: questions to ask about any agent security tool

• Does it find agents you didn’t register, not just the ones you did?
• Does every agent get a human sponsor and a review date?
• Does it watch how agents sign in, not just what they can reach?
• Does it read every grant and score its risk?
• Does it see when one app starts reaching into another?
• Does it join agent alerts to the sponsor’s account and mailbox?
• Can it fix the problem in place, at a setting you choose?
• Are disruptive steps always left to a person?
• Does it work across Microsoft and Google, and across every client tenant?

Frequently asked questions

What is Synthagent?

Synthagent is the guard agent inside Centeye Synthwatch. It constantly watches every AI agent’s identity, authentication, grants and connections, links what it sees to the people and data around it, and fixes problems at the setting you choose.

How is Synthagent different from Synthwatch?

Synthwatch is the product: the register of agents, their owners, their reach and the off switch. Synthagent is the guard agent inside it that watches all of that continuously and acts on it.

Does Synthagent work with Copilot Studio, Foundry and Gemini agents?

It works through identity and access in Microsoft 365, Microsoft Entra ID and Google Workspace, so it covers agents that hold access there whoever built them. Reading agents straight from the Copilot Studio and Gemini Enterprise registries, Microsoft Entra Agent ID and Google’s agent identities is coming. Agents built in Microsoft Foundry are covered when they reach Microsoft 365 through an app grant.

Will Synthagent shut an agent down without asking?

Only if you set that action to automatic, and only for clear-cut protective steps such as revoking one grant. Disruptive steps always wait for a person.

Is it available now?

Synthwatch and Synthagent are in early access. Ask to join and we’ll set it up on your own tenant.

New to the terms? See AI agent, non-human identity and OAuth grant in our glossary. For the step-by-step version, read how Synthagent works.

The worked example is illustrative. Synthwatch and Synthagent are in early access; this post describes what ships today and what is coming.