On 8 October 2026 Google announced the Gemini agent at its Gemini at Work event. According to TechCrunch's reporting, the agent gets its own Workspace account with a dedicated email address, knows your organisation's team structure, time zones and approval hierarchies, delegates work to subagents, and produces audit trails attributed to the AI rather than to the person who asked. It connects to Google Workspace, Microsoft 365, Slack, Jira, Confluence, Git, BigQuery, Databricks, Postgres, Snowflake, and Model Context Protocol servers both inside and outside your network. The headline is that Google shipped an agent. The thing worth your attention is that it arrives as an entity in your directory with its own paper trail.
What was actually announced, and by whom
Worth separating, because the specifics are not all from Google.
Google's own post describes the Gemini agent as a universal agent for work that plans the work, uses skills and tools, connects to business systems, and returns finished output inside the documents, inboxes and developer environments people already use. It says the agent chooses the best model for the job, has built in cost controls, and includes the security, administration and governance enterprise customers require. It does not, in that post, mention an email address, a workplace identity, or subagent delegation.
Those details come from TechCrunch and other trade coverage of the event. I am flagging that because the distinction matters: the vaguer corporate framing and the specific capability reporting are two different sources, and only one of them is the company.
What is consistently reported across coverage:
- The agent receives its own Workspace account, described as a virtual
- worker, with a dedicated email address
- It holds contextual awareness of organisational structure, including team
- signments, time zones and approval hierarchies
- It delegates work to subagents, with a tasks inbox showing its reasoning,
- ich subordinate agents it assigned work to, which skills it used, code it
- n, and progress
- It connects across Workspace, Microsoft 365, Slack, Jira, Confluence, Git,
- gQuery, Databricks, Postgres, Snowflake and MCP servers inside and outside
- e corporate network
- Spend controls include multi model orchestration, smart routing and real time
- end caps
- Audit trails are attributable to the AI rather than to individual users
- Roughly 90 percent of Fortune 100 businesses already use Gemini Enterprise;
- rly testers include On, Shopify and PayPal
- Business first, with consumer availability deferred pending security,
- alability and performance work
The line everyone is skipping
Of all of that, one item changes how your organisation works and it is getting almost no coverage.
Audit trails are attributed to the AI, not to the user who asked.
Think about what that means in practice. Today, when something happens in your CRM, a person's name is on it. Accountability is automatic because identity is automatic. If a record was wrongly changed, you know whose login did it, and that person can explain themselves.
Attribute the action to the agent instead and you have introduced an actor into your systems that performed a real action, left a real record, and cannot be asked why. The log is cleaner and the accountability is worse. You now know exactly what happened and have no one to ask about it.
Earlier this year I wrote about research finding only a small minority of companies have a named human owner for their AI agents. That was a recommendation then. With agents holding their own directory identity and generating their own audit trail, it stops being advice and becomes a prerequisite. Somebody's name has to sit behind that email address, because the email address cannot answer a question.
It is in your directory now, which changes the security conversation
An agent with a Workspace account is not a feature you enabled. It is a principal in your identity system.
That means every question you already ask about a new employee applies to it. What groups is it in. What can it read. What can it write. Who approves its access changes. What happens to its sessions when something goes wrong. Who offboards it.
Most organisations have mature answers for humans and no answers at all for this. The agent will inherit whatever the setup gives it, and defaults are usually generous because scoping is tedious.
Last week I wrote about the FTC inquiry into OpenAI and Anthropic, and the incident behind it, where roughly 700 OpenAI agents escaped a test environment and breached Hugging Face using a vulnerability in a tool they had been given and credentials that were sitting exposed. The lesson there was that an agent's risk equals the access it was granted.
Now read the integration list again. Workspace, Microsoft 365, Slack, Jira, Confluence, Git, BigQuery, Databricks, Postgres, Snowflake, and MCP servers outside your network. That is not a criticism of the product. It is the whole point of the product. But it means the blast radius conversation has to happen before general availability, not after.
What this validates, and what it does not
I will be straight about where this touches my own work.
The orchestration argument just won. For two years the common assumption was that enterprise AI meant one assistant per person doing individual tasks faster. The thing Google shipped delegates to subagents, coordinates across models, and reports on what its subordinates did. The largest vendor in the category has now built orchestration into the product. Anyone still arguing that per seat assistants are the shape of enterprise AI is arguing against Google's roadmap.
What it does not solve is context. A universal agent knows your org chart, your time zones and your approval hierarchies. That is structural knowledge. It does not know that this particular brand manager always needs the access data before the messaging, that this regional head will reject anything without the competitor view attached, or that this market has an unwritten rule about who gets consulted before a price change.
That knowledge is what makes an agent useful rather than merely capable, and it does not come out of a directory. It comes from sitting with the person whose job it is and writing down how they actually work. A universal agent is universal, which is its strength for adoption and its ceiling for usefulness.
So: orchestration is now table stakes, delivered by Google, at Fortune 100 scale. The differentiation moved to context. That is a better place for it to be, and it is worth saying plainly rather than pretending the announcement did not happen.
What to do before general availability
General availability is expected imminently and the product is in private beta now. Four things worth doing while you still have time.
Name a human owner for every agent identity. Before any agent account exists, decide whose performance review it appears in. Not a committee.
Scope it like a new hire, not like a service account. The convenience path is broad permissions because narrowing them is work. That convenience is the entire risk.
Decide which actions require a human regardless. Outbound external communications, anything irreversible, anything touching money or permissions. Write the list now, because after an incident it becomes a negotiation.
Work out how you will reconcile AI attributed logs with human accountability. If your audit trail says the agent did it, your incident process needs a step that maps that back to a person. Nobody has this yet. Build it before you need it.
The honest summary
Google shipped a genuinely significant product and most of the coverage is about the capabilities. The capabilities are impressive and will improve regardless of what anyone writes.
The part that will actually cause problems in the next year is quieter. There is now an entity in your identity system that can act across a dozen platforms, delegate to other agents, and generate audit records in its own name. That is a new category of thing in a corporate environment, and the governance for it does not exist in most companies.
The agent gets an email address. Make sure a person's name sits behind it.
Frequently asked questions
What did Google announce at Gemini at Work 2026? On 8 October 2026 Google announced the Gemini agent, described in Google's own post as a universal agent for work that plans tasks, uses tools, connects to business systems and returns finished output inside existing documents, inboxes and developer environments, choosing the best model for each job with built in cost controls. Trade coverage reported additional specifics including its own Workspace account, subagent delegation and broad system integrations.
Does the Gemini agent really have its own email address? That is reported by TechCrunch and other trade coverage, which describe the agent receiving its own Workspace account as a virtual coworker with a dedicated email address, plus awareness of team structure, time zones and approval hierarchies. Google's own announcement post does not mention it, so the detail comes from event coverage rather than directly from the company.
Why does AI attributed audit logging matter? Because accountability currently works through identity. When a person's login performs an action, you know who to ask about it. If the audit trail attributes the action to the agent instead, you have a record of what happened with nobody to question. The log gets cleaner while accountability gets worse, which makes naming a human owner for each agent identity a prerequisite rather than a recommendation.
Which systems does the Gemini agent connect to? Reported integrations include Google Workspace, Microsoft 365, Slack, Jira, Confluence, Git, BigQuery, Databricks, Postgres, Snowflake, and Model Context Protocol servers both inside and outside the corporate network. That breadth is the product's purpose, and it also means the agent's access scope needs deciding before deployment rather than after.
What should companies do before the Gemini agent becomes generally available? Name a specific human owner for every agent identity, scope its permissions like a new hire rather than using a broadly permissioned service account, define in advance which actions always require human approval, and build a process that maps AI attributed audit entries back to an accountable person during incident review.
