When the agent gets its own email address

For two years an agent at work has mostly borrowed someone else’s identity. It logged in as the person who started it, used their access and left their name in the logs. This month the two largest office platforms moved away from that. Google gave its agents accounts of their own. Microsoft said agents should be treated like insiders and watched by other agents. Together they describe a new kind of colleague, and a new job for whoever runs the company.

Google: an agent with an inbox

On 8 October, at its Gemini at Work event, Google introduced the Gemini agent, which it calls “your new single, universal agent for work.” Part of it are coworker agents. In Google’s words: “The agent receives its own Workspace account, including an email address, calendar, Drive, and presence in your company directory.” Colleagues add it to a chat space or mention it by name. It can comment in documents and appears under its own name in the version history.

The important sentence is about access: “A coworker agent acts under its own identity rather than yours, and it sees only what you share with it.” Around it Google lists audit trails attributed to the agent, permissions approved by a company’s security administrators, and spending caps per project that pause an agent when they are reached. The numbers show how fast this is moving: Google says SOMPO, a Japanese insurer, has built more than 10'000 custom agents across 34'000 employees.

Futurum, an analyst firm, read it as a workforce model: companies “will provision, permission, and audit agents through the same identity processes they use for employees”, which “gives security teams a clear line between human and agent actions in the audit log.” A Google representative told Futurum there is no plan to charge a seat licence for each coworker agent. How agent work will be metered instead is still open.

Microsoft: treat agents as insiders

Eleven days later Microsoft took the other side of the same idea. In a post titled “Securing the agentic insider”, Hayete Gallot, who leads Microsoft Security, wrote that “frontier models, regardless of their origin, cannot be trusted”, and that this is “not because models are inherently malicious.” Agents, she wrote, are “frequently overprivileged”. Microsoft’s answer is Guardian Agents, which “watch and moderate every action of every agent, before it happens, 24/7”, working from a risk score of what each agent is trying to do.

Every agent found in a company gets an identity, a container, and policies and permissions. TechCrunch reported that Microsoft Defender can now recognise up to 60 kinds of agents that employees bring to work, among them Claude Code, Codex and OpenClaw, and that a person has to approve when an agent appears to be making a risky decision. Satya Nadella put the principle in one line: “We simply can’t outsource responsibility for what intelligence does on our behalf.”

What changes when agents have names

An agent with its own identity is easier to govern than one hiding behind a person. You can see what it did, give it exactly the access its job needs, and switch it off without locking anyone out. Companies already treat people and service accounts this way. For agents it is overdue.

It also changes the questions a company has to answer. Who hires an agent, and who signs off its role? Which folders does it see, and who decided? Who reads its record, and who answers when it gets something wrong? A name in the directory makes an agent visible. It does not make it accountable. That still takes a person.

What to do now

Three things are worth doing before agents arrive in numbers. Make a list of the agents already at work, including the ones people installed themselves. Give each one its own identity and the narrowest access its task needs, never a person’s login. And write down who is responsible for each one, as you would for a new hire.

Then give the agents something worth knowing. An agent with an inbox and no company knowledge writes for a company that does not exist. Its value comes from the rules, prices, templates and systems it may use, with access set by role.

Where we stand

This is the direction we build in. Twin gives a company’s assistants and agents one brain, with its knowledge, rules and tools, secured by role. Helm, still in the making, is where we build a whole company run by agents, with one person at the helm who leads it and answers for it. Google and Microsoft have just made the same point from the other end: the agents get names, and a person keeps the responsibility.