A mailbox is not a counterparty.

A mailbox is not a counterparty.

Thursday, October 8. Google took the stage at Gemini at Work 2026 and shipped Gemini agent, pitched as a universal agent for work. You hand it an objective, not a list of instructions. It reaches into Workspace, Microsoft 365, Slack, Jira, Confluence, Git, BigQuery, Databricks, Postgres, Snowflake, and whatever MCP servers you point it at. It routes across models, Anthropic's Claude included. Spend caps, flexible spending. Private preview for enterprise, no price, no GA date. On, Shopify, and PayPal are the early testers they named. Pichai told the room roughly 90% of the Fortune 100 already run Gemini Enterprise.

The detail that matters is buried in the coworker part. A Gemini coworker agent gets its own Workspace account. Its own email, an @agents.company.com style address per The Verge. Its own directory entry, its own context. You tag it, email it, share a doc with it, drop it into a chat. When it edits something, the audit trail says the agent did it. Not a person.

Same day, Zone & Co launched AgentHQ inside its Zone Control Center. Ten-plus specialist agents for NetSuite AP and close: bill matching, bill payment, period close. They take approved write actions directly in the ERP. One place to decide what each agent can do, when it runs, and what needs a human to sign off. Billie Miric, their Global Head of Product, said giving an AI agent a job is only half of it. The bigger shift is multiple agents with different authority levels.

Two days earlier, Tuesday the 6th. AlphaSense previewed SuperAnalyst at AlphaSummit, an always-on agent you delegate an objective to. It plans, researches, reconciles evidence, runs code, ships memos and models and dashboards that refresh, then keeps watching the assumptions after the first pass is done. Same day OpenAI put the Decisions API into public beta on GPT-6 Luna. Predicates, choices from a fixed set, scores. About 10x faster than the Responses API for that job, $0.10 per million input tokens, no charge on output. It doesn't write tool arguments. It picks.

Last week was supervision versus the hire. This week the buyer side started minting the agent as a coworker. Mailbox, directory, a name in the version history. Nobody minted the counterparty.

The read everyone had

Default take: agents finally got a real seat. Google made the coworker a first-class Workspace citizen so IT can manage it like a person. Zone gave AP agents write access behind approvals. AlphaSense made the analyst always-on. OpenAI made routing cheap. Identity handled, autonomy up, cost down, ship it.

That read gets the plumbing right. It's wrong about what an email address is.

A directory entry is not a signature

Think about what a new employee's mailbox actually does. It's a place to route work and a name to hang logs on. It doesn't let the new hire sign a supply contract. That authority comes from somewhere else entirely: an offer letter, a delegation of authority matrix, a signing limit somebody in finance set, a board resolution if the number is big enough. The mailbox shows up on day one. The power to bind the firm shows up in pieces, if at all, and it lives in documents the directory never reads.

Google just gave agents the day-one stuff. That's useful. Attributing the edit to the agent instead of to whichever human launched it is an honest fix for a real mess, and I'd rather have it than not. But look at what the agent can now do with that identity. Email a vendor. Share a Drive folder with an outside party. Post in a Slack Connect channel. Reply on a Jira ticket a customer can see. To the person on the other end, a note from procurement@agents.yourco.com reads a lot like it came from the company.

The counterparty doesn't see your delegation matrix. They see your domain.

i keep landing on that asymmetry. Inside the firm the agent identity is an admin object with least-privilege scopes. Outside the firm it's a return address with your brand on it. Apparent authority is the old doctrine for exactly this: dress someone up so a reasonable outsider believes they speak for you, and you can end up bound by what they said. Nobody wrote it with software in mind, and it reads on a mailbox fine anyway.

Zone is the more careful version of the same week. AgentHQ says out loud that writes are approved and that agents carry different authority levels. Right instinct, pointed at the ledger. It still lives inside NetSuite. A bill payment approved in Zone Control Center settles something the firm already owed. It doesn't create a new promise to someone outside.

Decisions API is the clean contrast, almost accidentally. It chooses from options you fixed in advance and charges nothing for the answer. Classification, routing, a score. Picking from a menu commits the firm to nothing. And SuperAnalyst can watch your assumptions forever without being on the hook for one of them. Always-on is a schedule. It isn't standing.

The machine-speed problem

A human hire with a fresh mailbox gets weeks of slack before anyone outside trusts them. Onboarding. Vendors don't know the name yet. Their manager reads the first emails over their shoulder. The authority gap closes about as fast as the reputation forms, which is slowly, which is the point.

An agent gets neither the onboarding nor the reputation lag. It's in the directory at minute one, on the shared doc by minute two, and it can send a hundred well-formatted emails before lunch from a domain your suppliers have trusted for a decade. Spend caps meter tokens. They don't meter what the agent said yes to.

I wonder if the first ugly dispute out of this isn't a rogue agent at all. It's a perfectly scoped coworker agent that answered a supplier's "can you confirm the revised quantity?" with "confirmed," because confirming sat inside its objective, and a supplier who reasonably took the company's domain at its word and shipped.

What the right layer looks like

Thinner than another identity product. Any agent with an outside-facing surface needs a statement of what it can bind the firm to, kept separate from what it can access. Signing limits in dollars. Which counterparties. Which kinds of message count as a commitment and which are just a reply. Who inside the firm stands behind it. Readable by the other side before they act on the email, not reconstructed from the agent's audit trail after the truck leaves.

Access is what the directory knows. Authority is what the counterparty needs to know. Right now only the first one ships with the mailbox.

Zone gets closest because it names authority levels at all. Google gets attribution right and leaves the outward meaning of the address undefined. The Decisions shape is a hint somebody should steal: fixed options, no free-text commitment. "This agent can only say one of these five things to a vendor" ought to be a term the vendor can read, not a line in a prompt.

The order is always wrong

#027 was refuse on identity, seller side. #028 was the procedure nobody owned. #029 was the hire versus containment after the sprawl. This week the buyer handed the agent a name tag and a desk.

Same sequence, one layer further out. Presence first: email, directory, version history, a chat handle. Then capability through every connector. Then spend controls. The question of who the agent can bind, and how anyone outside could check, arrives last, usually inside a letter from somebody's lawyer.

I've watched physical markets do this with brokers and introducing agents for years. The business cards always get printed before the authority letter gets signed.

Close

Thursday Google gave Gemini coworker agents their own Workspace account, email, and an audit trail with the agent's name on it, in private preview with On, Shopify, and PayPal testing. Zone put approved write actions inside NetSuite with authority levels per agent. Tuesday AlphaSense made the analyst always-on, and OpenAI made picking from a fixed list cost ten cents per million input tokens.

Last week supervising an agent wasn't the same as hiring it. This week giving it a mailbox isn't the same as letting it speak for the firm.

Watch who ships the signing limit next to the email address. A mailbox is not a counterparty.

Max

Disclosure: Accords, where I'm Executive Chairman, is a portfolio position I chair.

Max Curnin has spent 11 years and 45+ investments on the physical rebuild of the economy: energy, compute, robotics, and the materials underneath. He writes The Agent Economy on the category he invests in.