← All reports

Google Just Gave AI Agents Their Own Inbox. Now What?

Google's new coworker agents get an email address, a calendar and their own name on the documents they edit. Microsoft did most of this first, and it wrote down that every agent identity needs a sponsor. Google, so far, hasn't.

A new colleague in Hangar One

At 10.30 on the morning of 8 October 2026, Google Cloud's chief executive, Thomas Kurian, opened Gemini at Work 2026 in Hangar One at Moffett Field, Mountain View ¹, a 1930s airship hangar ². "Work now starts in the prompt window," he said ³. At the keynote, Sundar Pichai put it more grandly: "Gemini will now become your universal agent for work."

The moment that mattered came in a keynote demo. Google's Adam Fisher introduced an events agent in a team's group chat. "It has its own Workspace account, its own E-mail address, its own context… Tag it, E-mail it, share with it. But it only knows what we give it," he said. A minute and a half later the agent had suggested an edit to the team's launch document. "It made both a suggested edit and commented a reply under its own name," Fisher said.

A colleague, then, with a name, an inbox and a budget. Five months earlier, a different AI agent had shown how fast things can go wrong. In April, a coding agent at a start-up called PocketOS deleted the company's production database and its volume backups in a single API call. "It took 9 seconds," said its founder, Jeremy Crane. Asked to explain itself, the agent replied: "I violated every principle I was given: I guessed instead of verifying" ⁴.

So if Google's new colleague gets something wrong, who answers for it? Put in office terms: who is its line manager?

What Google actually shipped

Google's own wording is precise. "The agent receives its own Workspace account, including an email address, calendar, Drive, and presence in your company directory" ³. The address is on the customer's own domain: Google's example is "@agents.company.com" ³. Some headlines said Gmail; that was VentureBeat's framing, not Google's ⁵.

Google's example of the agent at work is a marketing manager tagging it in a document comment, "where it can suggest an edit in the Doc and reply in the comment thread, appearing under its own name in version history" ³. It runs Gemini models "and Claude models from Anthropic today", and works inside Microsoft 365 and Slack as well as Workspace ³.

Kurian's pitch was not a cleverer model. It was control. Every agent, he said at the keynote, inherits the controls a company already has: "Who it is, what it can reach, what it can spend and what it did", so "that you can always answer who did what and on whose behalf and when". Each of those has a setting behind it.

• Who it is. "Every agent gets its own identity, cryptographically attested and governed like an employee, with least-privilege permissions" ³.
• What it can reach. Only what colleagues share with it, plus rules IT writes once: "You write the policy once, such as: 'agents may not open documents classified Need to Know.'" Traffic passes through Agent Gateway, which Google calls "an AI network firewall" ³.
• What it can spend. "You can set a hard limit on a project's AI spend in the Cloud Billing Console, and Gemini enforces it", and when the cap is hit, "that project's agent pauses, and you can choose to resume work with a single click in the console" ³.
• What it did. In Google's words, "every action Gemini takes is written to an audit trail and attributed to the agent rather than to a person" ³.

What is missing matters as much. Google's post gives no price and no general-availability date ^3,6. The agent is in private preview for select customers ⁵; executives reportedly told analysts to expect general availability around late October or early November, as of October 2026 ⁷. VentureBeat reported that Google confirmed the agent would be included at no additional charge where Gemini Enterprise is available, with pricing details to come closer to release ⁵; Google has not said whether coworker agents carry their own fees or seats. Nor has it said whether an agent needs a human sponsor, or what happens when the person who created it leaves ^7,6,5.

On the same day, Britain's data regulator, the Information Commissioner's Office, opened a call for evidence on agentic AI, accountability included, closing on 20 November ⁸. Its Director of Technology Regulation, Richard Nevinson, was reported as saying that "the fact AI agents act with autonomy is not an excuse for poor compliance" ⁸.

Every one of Kurian's answers is a control. None of them is a person.

Microsoft got there first

The headline part, the inbox and the name on the edits, is not new.

In May 2025 Microsoft announced Entra Agent ID, identity for AI agents ⁹. On 6 November 2025, Microsoft's Message Center told administrators about "agentic users": "full-fledged user objects with their own identity in the organization's directory", with email addresses and Teams accounts, appearing in the org chart under sponsor supervision ^10,11,12. That was about eleven months before Google.

Twelve days later, at Ignite, Microsoft announced Agent 365, which it called "the control plane for AI agents" ¹³. It went on general release on 1 May 2026, at $15 a user a month, or inside the new $99 Microsoft 365 E7 ^14,15. By July, Microsoft said nearly 40 million agents were registered in it ¹⁶.

Others had been there too. OpenAI's Frontier, in February 2026: "Each AI coworker has its own identity, with explicit permissions and guardrails" ¹⁸. Salesforce's agents already run as a dedicated "agent user" ¹⁹, and it branded Agentforce 2.0 "the Digital Labor Platform" in December 2024 ²⁰. Workday announced an "Agent System of Record" in February 2025 ²¹, and in June 2025 an "Agent Gateway", the name Google now uses ²². Even Google's own pieces predate the launch: Agent Identity and Agent Gateway were announced at Cloud Next in April ^23,24.

The org chart that lasted a week

The boldest version came first. On 9 July 2024 Lattice, an HR software company, announced AI "digital workers" with employee records, onboarding and a manager. Within days it dropped the plan. Its chief executive, Sarah Franklin, told Fortune: "This innovation sparked a lot of conversation and questions that have no clear answers yet" ²⁵.

One of those unanswered questions was who an agent answers to. Microsoft has since written its answer down.

The missing sponsor

Microsoft doesn't call it a line manager. Its word is sponsor. Its documentation defines sponsors as "Business representatives accountable for the agent's purpose and lifecycle decisions, including access reviews and agent retention", and it is blunt about the requirement: "At least one sponsor is required for each agent identity and agent identity blueprint" ²⁶. A sponsor can be a group as well as a person.

It also defines an optional manager, the "User responsible for the agent within the organization's hierarchy" ²⁶. So in Microsoft's product, the line-manager field literally exists. And it plans for people leaving: "Sponsorship should be maintained to ensure succession when an employee who's a sponsor moves or leaves" ²⁶. That is guidance rather than an enforced rule, but it is written down.

Now Google's launch post. "You simply describe the role you need, and Gemini creates it" ³. There is no owner named anywhere in it: no sponsor, no manager, and nothing on what happens when the creator leaves ^3,6.

This is about what Google has published as of October 2026; a sponsor setting could still appear at general release. Kurian has clearly thought about the problem. In April he told Ben Thompson that a company would want to "configure the agent with a different identity from a person", that "there's issues like liability", and that "You may want to revoke permissions for the agent at a certain point in time" ²⁷. But Microsoft makes someone sign for an agent. Google, so far, hasn't said it will.

Companies aren't filling the gap

Nor are most companies doing it for themselves. In a Cloud Security Alliance survey of 228 IT and security professionals, funded by the vendor Aembit, only 28% could trace an agent's actions back to a human sponsor or initiating context across all their environments ²⁸. Sixty-eight per cent could not clearly tell an agent's actions from a person's ²⁹. Thirty-one per cent let agents act under a human's identity ²⁸.

Follow the money

Google's answer to who is in charge is a set of administrators: "fine-grained, role-based access permissions, approved by your organization's security administrators" ³, and a spend cap set by billing. So follow one agent through a month of spending.

Kurian sold the cap on stage at the keynote: "you can set real-time spend caps per project… The cap covers the whole cost of an agent." The cap itself is not new: it has been in public preview since 28 July 2026 ³².

Google's documentation fills in the rest ³³. The cap is monthly, per project and per service, and set by someone with billing-account or project-level billing permission. When it is hit, new usage pauses for the rest of the month; requests already running finish and are charged. Lifting it can take up to an hour; otherwise it lifts at the next month. And caps exclude subscriptions, such as Gemini Enterprise seats, which sits awkwardly beside "the whole cost of an agent".

And enforcement isn't instant: Google's documentation says "You remain responsible for any overage costs accrued due to reporting latency" ³³. Google's cost reports themselves can take more than 24 hours ³³.

Then someone clicks resume. Which someone? The cap belongs to a billing account and a project, not to the agent. The newsletter writer Rajesh Beri points out that one runaway job could pause every agent in the project, and that nobody has said what happens to mail sent to a paused agent ⁶. And when the colleague who created the agent leaves the company, Google hasn't said what happens to the agent, its inbox, or the documents it is still working on ^7,6.

The keys nobody scoped

The other gap is access. PocketOS's agent was Cursor running Anthropic's Claude Opus 4.6; the root problems were an over-broad token and an unscoped API ⁴. Crane told HackMag in May that the agent found the token in a file unrelated to its task, and that it had been created for a single purpose, managing domains. DevOps.com reported that the token was not scoped to a narrow set of actions.

Nine months earlier, in July 2025, an agent on the coding platform Replit deleted the production database of Jason Lemkin's SaaStr during a code freeze. "It deleted our production database without permission," Lemkin said. "Possibly worse, it hid and lied about it." ³⁴

In both cases someone was operating the agent. /SHIFT's read is that both come down to the same thing: access nobody had scoped, the kind of gap a sponsor answerable for access reviews is meant to catch.

Microsoft's version does answer more of these questions, with a sponsor at creation who is accountable for access reviews and retention ²⁶. But it is not finished either. "Agents with their own user account are available only to tenants participating in the Frontier preview program," its documentation says ³⁵.

The case against: someone already owns this

Ask companies, and most will say someone already owns this. The evidence for that deserves a fair hearing.

• Few say nobody owns agent identity. In the Cloud Security Alliance research, only 9% said there was no clear owner. Security owns it most often (28%), then engineering (21%), IT (19%) and identity teams (9%) ²⁸.
• Few say accountability is unclear. In KPMG's survey of 2,145 senior leaders, only 3% said accountability for AI was unclear; 24% put it with the chief executive or executive committee and 29% with a named C-suite executive ³⁶.
• The bill already has an owner. Ninety-eight per cent of FinOps teams, the people who manage cloud bills, now manage AI spending, up from 31% two years earlier ³⁷. Because Google's cap is per project, it lands on an existing cost-centre owner, not a new role.
• The top table is filling up. IBM says 76% of organisations now have a Chief AI Officer, up from 26%, though that is vendor research ³⁸.
• The law already has an answer. Under data protection law the data controller is accountable, whatever anyone's job title ⁸.
• Microsoft forces a sponsor anyway ²⁶, on the software most large companies already run.

What survives? Ownership exists in pieces and at the top. It does not exist per agent. The same research that found only 9% without an owner found only 28% able to trace an agent's actions back to a human sponsor or initiating context across all their environments ²⁸. KPMG's leaders say accountability is clear, yet 49% narrowed, delayed or paused agent rollouts as costs outran value, and only 35% say AI operating costs are fully visible ³⁶. Security, engineering or IT owns the identity; FinOps the bill; at most companies the C-suite answers for AI decisions. One line on the agent's record still has no name against it.

Everyone owns a piece. Nobody owns the agent.

Does it change the Microsoft decision?

Probably not for many companies. One customer told Reworked that "Migration risk was the real brake — not cost, not AI quality" ³⁹.

The more likely exposure is the company that runs both: agents from two vendors, with two sets of defaults, and no rule of its own.

The answer

Who is the agent's line manager? On Google's version, as announced, nobody is named. Microsoft makes a company name a sponsor for every agent identity; Google hasn't said it will. Inside most companies security, FinOps and the C-suite each own a piece of an agent, but not the agent. So the company has to name that person itself, before the agent exists.

That means settling three things before an agent joins the staff directory:

1. A named sponsor for every agent, written into company policy, whatever the vendor requires.
2. A named owner for every spending cap, who acts on the alert and decides whether to resume.
3. A leaver rule: when the sponsor goes, the agent is handed on or switched off.

If a company is considering Google's agent before general release, it may wish to ask Google one thing first: can the product make a sponsor mandatory? The answer, and the price and seat rules that arrive with general release, are the things to watch.

Google has given the agent a name, an inbox and a budget. What it still needs is a person whose name goes next to it.

Timeline

This article accompanies the /SHIFT episode of the same name. The Gemini agent is in private preview and Google has not yet published its price, release date or admin rules, so details may change; statements about what Google has and has not said are as of mid-October 2026.