At Gemini at Work 2026 on October 8, Google Cloud CEO Thomas Kurian announced something that sounds almost science fictional: enterprises can now give a Gemini agent an actual Workspace account, a standalone email address (in the form @agents.company.com), a calendar, Drive storage, even its own entry in the company directory. A manager describes what a role needs to do, and the system creates an agent that holds its own Workspace account. Colleagues can add it to a Chat space, @ mention it in a doc comment, and its edits show up under its own name in version history. This isn't another smarter-model release, it's Google's first real attempt to slot an agent into the organizational chart itself, giving it the same kind of identity slot a human employee holds.
One universal agent replaces a pile of scattered features
Google describes this new Gemini agent as a single, universal agent for work that answers your questions, handles your knowledge work, creates your images and media, and writes and runs code. You can chat with it directly, or assign it an objective, a schedule, or a trigger event. It runs persistently in the cloud with shared memory and a personalization graph, meaning a job that takes hours or days keeps running after you close your laptop. The more important part is orchestration: the Gemini agent can route across both Google's own Gemini models and Anthropic's Claude models, and administrators can route individual jobs across more than 200 different models. It also connects directly to Google Workspace, Microsoft 365, Slack, Jira, Confluence, Git, BigQuery, Databricks, Postgres, Snowflake, and any server following the Model Context Protocol (MCP, a standardized way for AI models to call external tools). In other words, Google isn't settling for bolting an AI feature onto one app anymore, it wants to be the work layer that spans every tool and is itself the entry point.
Now that it has an identity, how is accountability actually enforced? Cryptographic attestation and audit trails
Giving an agent an email address is just the surface. The real difficulty comes after: once an agent can read files, write documents, and call systems the way an employee would, who's accountable when something goes wrong? Google's approach is to give every agent a cryptographically attested identity, stamped into every log it produces and into any virtual machine it starts. Kurian put it plainly in the announcement: every agent gets its own identity, cryptographically attested and governed like an employee, with least-privilege permissions, and every action Gemini takes is written to an audit trail and attributed to the agent rather than to a person. All traffic passes through what Google calls an AI network firewall, the agent itself runs inside an isolated environment called Agent Sandbox, and outbound calls go through Agent Gateway. A Google spokesperson confirmed to the press that an agent can only access files explicitly shared with it through Workspace permissions, it doesn't default to the same access scope as whoever created it, it gets authorized item by item, the way a new hire would.
Why this matters more than "yet another smarter model"
For the past few years, enterprise AI procurement has mostly run on one logic: use whichever model is smartest. But that logic starts breaking down once agents actually enter production, because capability was never the real bottleneck, accountability was. If an agent misreads a contract, breaks a line of code, or sends internal data somewhere it shouldn't, and the log just says some service account performed an action, IT and compliance have no way to trace it, let alone assign responsibility. What Google is really doing here is answering a more practical question than how smart the model is: once an agent genuinely works like an employee, how does an enterprise apply the same machinery it uses to manage employees, identity, permissions, logs, accountability, to manage it. This echoes a voice from the other end of the industry too: Box CEO Aaron Levie has publicly predicted that in five years, 90% of enterprise token consumption will be kicked off by no human at all, calling it one of the most complex security and governance challenges of the 21st century. Identity and audit infrastructure are exactly the precondition for whether that scale can hold up.
"Every agent gets its own identity, cryptographically attested and governed like an employee, with least-privilege permissions." — Thomas Kurian, CEO of Google Cloud
Gemini at Work 2026 keynote
For small teams, this shouldn't be a large-company-only luxury
Google's setup is still in enterprise private preview, with no published pricing, and it's clearly designed for large companies with dedicated IT and compliance teams, an ordinary small team isn't going to stand up its own Agent Sandbox plus Agent Gateway plus cryptographic attestation stack. But the direction it validates is the right one: once an agent starts actually doing work for you, it needs a clear identity boundary, a permission scope it can itself understand, and a record you can check at any time, not a black-box script vaguely sharing all of your account's privileges. For individuals and small teams using an avatar platform like KarmaBox, the same logic applies. Even without an enterprise-grade audit system, your AI avatar should still have its own memory and permission boundary, what tasks it's taken over, what tools it's called, and when it needs your nod before proceeding should all be things you can see clearly at any moment, not something you assume is fine just because it's smart enough. Identity and auditability were never something only large companies deserve, large companies just got there first and turned it into a product.
