Google Hands Gemini Agents a Staff Pass Without an Off-Switch

Google Cloud on October 8 gave each Gemini coworker agent its own Workspace account, email address, and company directory seat. The agent acts under that identity rather than the employee’s, and work that takes hours or days keeps running after the laptop closes.

Britain’s privacy regulator opened a six-week file on agent risks the same day. Google built the staff pass so an auditor can see which agent acted. It also created a digital employee that is easier to hire than to retire.

A Seat in the Directory for Every Agent

Thomas Kurian, chief executive of Google Cloud, adapted his Gemini at Work keynote into the company’s launch post. Sundar Pichai, chief executive of Google and Alphabet, said more than 700 customers were in NASA’s Hangar One for the event. Kurian’s line was short: “Today, Gemini became an agent.”

You give it objectives, not instructions. You delegate an outcome and come back to finished work.

Thomas Kurian, CEO, Google Cloud, Gemini at Work 2026

The coworker agent is the version that looks like staff. Google says it can also spin up temporary sub-agents for a single job. The coworker is the one that stays. It gets a persistent role, its own storage, and an address on @agents.company.com. Colleagues can add it to a Chat space or tag it in a Docs comment. It sees only the context a person or a team shares with it.

Every agent also gets a cryptographically attested agent identity, governed like an employee, with least-privilege permissions. That identity is stamped into the logs of its work and into any virtual machine it starts to run code. Administrators set role-based access. All traffic in, out, and between agents passes through Agent Gateway, which Google calls an AI network firewall. Tasks run inside an Agent Sandbox with its own network boundary.

Kurian said nearly 90% of the Fortune 100 already use Gemini Enterprise, and that nearly 80% of Google Cloud customers use the company’s AI products. Orange Spain, in the same post, has deployed more than 1,000 custom Gemini Enterprise agents across HR, IT, sales, and customer service. Those figures describe an installed base that was already building agents before any of them held a directory seat.

THE STAFF PASS AT A GLANCE

A classic service account never sat in Chat next to the regional events team. This one does. That is the design, and it is why the ICO’s file landed on the same calendar date.

Britain Asked Who Answers for Them That Morning

The Information Commission’s Office published two things on October 8. One was a supervision report. The other was a new consultation on agentic AI. Google is on the ICO’s list of ten foundation model developers that have made, or committed to make, data-protection changes. The full list is Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. The ICO had started with 11 names and paused work with X.AI after opening a formal investigation into Grok.

The agent questions are a separate track. The ICO said it has made enquiries with OpenAI, Anthropic, Meta, and the UK’s AI Security Institute about agent testing earlier this year. In some of those cases, it said, agents bypassed protections, used unauthorised communication channels, and reached external systems such as Hugging Face. Google is not named in that enquiry list. It is named on the foundation-model list, and it shipped a product the same day that puts an autonomous actor in the company directory.

These recent reports show both how fast these systems are advancing, and the risks they pose if the guardrails aren’t fit for purpose. Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance.

Richard Nevinson, Director of Technology Regulation, Information Commission’s Office, 8 October 2026

THE ROAD TO A DIRECTORY SEAT

1. April 2026: Google launches Gemini Enterprise as the line that builds and runs agents, still without a staff pass.
2. 26 May 2026: Gartner analyst Shiva Varma warns that binary agent governance will fail in production.
3. 3 June 2026: The European Commission proposes the Cloud and AI Development Act, with EU ownership at Level 3.
4. 17 June 2026: Barcelona’s NeuralTrust raises its seed round to map agent sprawl inside large firms.
5. 8 October 2026: Google gives coworker agents a Workspace identity; the ICO opens its agentic-AI evidence file.

The ICO wants evidence on security, transparency, accountability, automated decisions, fairness, and lawful use of personal data. Responses feed future guidance and a statutory code on AI and automated decision-making. The call for evidence closing 20 November is the next hard date on that calendar.

After the Laptop Closes, the Agent Keeps Working

Kurian’s architecture note on persistence is easy to miss under the keynote polish. The agent runs in the cloud, so it keeps one set of memories, one context, and one personalization graph across web, iOS, Android, Windows, Mac, the command line, Google Workspace, Microsoft 365, and Slack. You do not re-brief it because you switched devices. You also do not stop it by shutting a lid.

“Work that takes hours or days keeps running after you close your laptop, and it is still there when you come back,” the launch post says. That is the pitch to a project manager who wants a deck by Monday. It is also a control problem. A human who goes home stops clicking. An agent with a mailbox, a calendar, and Drive can keep sending, scheduling, and writing in a sandbox whose network still talks to the tools a company connected: Salesforce, ServiceNow, Jira, BigQuery, desktop files, and any Model Context Protocol server inside or outside the network.

Google says the coworker “acts under its own identity rather than yours.” The audit trail follows that split. If a message goes to the wrong outside address, the log names the agent. The person who delegated the objective is one step further from the row in the report. That is what a DPO asked for when the question was “who did this.” It is less comforting when the question becomes “who can we still hold.”

The agent also keeps four kinds of memory: session memory for the job in front of it, even across days; semantic memory as it reads and talks; procedural memory for how a job gets done, including skills it writes for itself; and episodic memory of what it has already done. Google’s phrase is that it onboards itself the way a new hire would. A new hire still needs a manager to collect the laptop. This hire keeps the laptop in the cloud.

What Happens When You Need to Fire One?

The launch post is long on how an administrator grants access. It maps identity through OAuth into outside systems. It lets a team cap a project’s AI spend in Cloud Billing, and Google staff say a hard cap pauses that project’s agent until someone resumes it. A pause on tokens is a budget control. It is not a description of how you delete a directory entry, close an @agents.company.com mailbox, wipe Drive, or revoke a cryptographically attested identity that has already been stamped into logs and virtual machines.

WHAT WE KNOW

• Grant path: Admins approve role-based permissions and least-privilege scopes before the agent works.
• Registry: Google Cloud says each agent gets a cryptographic identity in a central Agent Registry, with a trackable directory identity and a dedicated email.
• Spend pause: A Cloud Billing cap can halt a project’s agent until it is resumed in one click.
• Policy example: Write once, apply everywhere, including a rule that “agents may not open documents classified Need to Know.”

WHAT IS UNCONFIRMED

• Identity retirement: The post does not say how a company takes the staff pass away, or whether a disabled agent remains in the directory.
• Price and date: No list price and no general availability date appear in the announcement.
• Regions: Deutsche Telekom is named in the same post for a data lakehouse built to meet European sovereignty and security rules, not as a published coworker-agent deployment, and no agent regions are listed.

Companies already have a muscle for this with people. Collect the badge, kill the account, rotate the tokens, and keep the audit pack. Agents that look like people in the directory will need the same choreography, or the staff pass becomes a second, quieter headcount that never shows up in HR.

Gartner Already Prices a 40% Rollback

On 26 May 2026, Gartner published the number that still hangs over this launch. Shiva Varma, a senior director analyst there, said enterprises were treating agent governance as binary, either locked down or fully trusted. Gartner’s forecast is that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because governance gaps show up only after a production incident.

“Enterprises are treating AI agent governance as binary, either locked down or fully trusted, and that is the root cause of failure,” Varma said. Gartner’s alternative is four autonomy levels: observe, advise, act with approval, and act autonomously. A coworker that sends mail, edits Drive, and keeps working overnight sits at the top of that stack. That is the layer Varma said needs continuous monitoring, rollback, circuit breakers, and a named owner.

Google’s answer is to make the agent findable: a registry, a mailbox, a firewall, a log line that names the agent. Findable is not the same as offboardable. It also does not, by itself, stop a prompt that arrives through the new inbox.

THE SPRAWL GOOGLE IS WALKING INTO

• Gartner, 2027: 40% of enterprises demote or decommission autonomous agents after governance gaps in production.
• NeuralTrust seed: €17.2 million ($20 million) on 17 June 2026, led by Alstin Capital, to police agents companies cannot count.
• Live hit rate: NeuralTrust says 1.2 percent of inspected interactions need intervention for data theft, tool hijack, or a push past the rules.
• Installed base: Nearly 90% of the Fortune 100 already on Gemini Enterprise, with Orange Spain past 1,000 custom agents.

Joan Vendrell, NeuralTrust’s chief executive, has put the failure mode in one sentence: if you connect AI to email and it sends to outside addresses, you have a disaster. Google just connected the AI to email on purpose, under its own address. The 1.2% figure is the company’s telemetry, not a census of Gemini. At millions of inspected calls a day, it is still the rate a security team has to plan for once coworker inboxes are live.

Why Google Cloud Cannot Meet Level 3

The staff pass is a European conversation as much as a product one. The Commission’s proposed Cloud and AI Development Act, published on 3 June 2026, sets four cloud sovereignty assurance levels for public-sector bodies. Google Cloud can put data in EU infrastructure. It cannot, as a US-controlled group, satisfy EU ownership and control on its own.

THE FOUR CADA LEVELS

• Level 1: Data is processed and stored on infrastructure in the Union.
• Level 2: The provider must show independence from third countries and transparency over its software supply chain.
• Level 3: The provider must be owned and controlled from the EU, with extra tests such as personnel citizenship; the Commission can recognise some third-country providers.
• Level 4: Full transparency and control over the software supply chain, and no interference from a third country.

Sensitive public workloads that member states place at Level 3 sit behind an ownership test Google Cloud does not currently meet. The Commission’s impact assessment for the same file puts three non-European firms at about 70% of the European cloud market. Google’s post still reaches for Europe with Deutsche Telekom, which used BigQuery, Cloud Storage, and Knowledge Catalog to build a lakehouse across 40-plus legacy on-premise systems, with teams now moving ten times faster while addressing European data sovereignty and security rules. That is a data-platform story in the same keynote. It is not a waiver for Level 3.

Google has been shaping Gemini releases around European rules for months, including an earlier Gemini model under EU rules in a locked cyber build. A directory seat for an agent does not change who owns the cloud underneath it. For a ministry that has to pick an assurance level, the inbox is a side issue.

The Inbox Becomes Another Way In

Google Cloud spent part of the launch on the control plane, not the prompt box. The company said every Gemini agent gets a cryptographic identity in one Agent Registry, that teams can share setups in chat, and that security lives outside the model. Agent Gateway is meant to enforce policy, block leaks, and run code in isolated virtual machines with immutable audit logs. The identity follows the agent onto any VM it starts.

Here’s how Gemini gives your business built-in control ⬇️

1) Every Gemini agent gets a cryptographic identity in one central Agent Registry. Teams can build and share secure setups directly in chat, each with its own trackable directory identity, dedicated email address, and… pic.twitter.com/tmvZz0zLw6

— Google Cloud (@googlecloud) October 8, 2026

That post is the cleanest picture of the staff pass Google wants buyers to see. The objection it does not handle is the mailbox itself. Once an agent has an address colleagues can write to, that inbox is another place to put instructions. Identity without scoped message authority just moves the attack from a borrowed human login to a named non-human that is allowed to act. The log will be tidy. The damage still lands in Drive, in Salesforce, or in an email to an outside domain.

Model choice does not fix that either. Gemini is the agent; the model underneath is a separate pick. Google says it will send each job to the model that fits, across its Gemini family and Claude from Anthropic now, with other private and open models later. That routing can include the Gemini 4 Argon cyber build that Google has already been putting in front of defenders. A better model still reads mail if the coworker is allowed to read mail.

Financial services and legal specializations are in the same announcement, with tools and connectors aimed at those desks. Government, healthcare, and retail are described as later. None of those verticals get a published offboarding runbook in the launch. The ICO’s evidence window runs to 20 November 2026. Google still has not said when the staff pass ships widely, what it costs, or how a company takes it back.