An AI agent with its own email address. Where is its job description?
Google has announced an agent with its own account, email address and action log. Before handing it the keys, write three lists: alone, proposes, never.
Google has just announced a new colleague for your teams. It has its own email address, its own calendar, its own access. It is not a human.
The question for a business owner is simple: do you hand it the keys?
I have not, so far. And yet I have one of my own.
What Google announced
On 8 October 2026, at a Google Cloud event, Google presented a single agent for Gemini, aimed at businesses first. Thomas Kurian, who runs Google Cloud, describes it as an agent you give “objectives, not just instructions”: it plans the work, uses tools and connects to internal systems.
What interests me lies elsewhere. This agent receives its own Google Workspace account, like a member of staff:
- an email address in its own name, a calendar, file storage and a place in the company directory
- knowledge of the context: who is on which team, who has to approve what, what is in people’s calendars
- connections to the company’s tools, including Google Workspace, Microsoft 365, Slack, Jira and databases
- an audit trail in which every action is attributed to the agent rather than to a person
You call on it by mentioning it, emailing it, sharing a document with it or adding it to a group chat.
What changes in kind
Until now, an AI assistant worked inside someone’s session. It drafted in your mailbox, under your name, and you were the one who pressed Send. Responsibility followed the click.
With an account in its own name, the agent no longer helps someone. It acts.
There is something good in that choice, and it should be said. An audit trail attributed to the agent is more honest than an action taken by an AI and signed by a human who never read it. You know who did what. That is real progress on traceability.
But traceability answers the question “what happened?”. It does not answer “what was it allowed to do?”. And an agent has one trait a colleague does not: when it is wrong, it does not know it. It does not hesitate, it does not ask, it does not warn you. An audit trail will tell you tomorrow, in great detail, which mistake it made yesterday.
My agent sends nothing
I have had a prospecting agent running since June. It drafts my messages. It has never been allowed to send a single one: I reread, and I send.
That is not a technical limit. It is a decision, taken because a badly targeted prospecting message lands with someone I will not be able to approach cleanly again. The mistake is irreversible and it happens outside the company. Those two criteria are enough to keep a human in the loop.
Am I being too careful? On this process, perhaps. On others, the agent could act alone at no risk. That is exactly the point: the answer depends on the process, not on the tool. It is the automation dial, set according to what is at stake.
An agent’s job description
My position: giving an agent an email address without writing down what it is allowed to do is hiring without a job description.
Nobody recruits someone and hands over every key on day one without saying what is expected. For an agent, the job description fits in three lists.
| List | What goes in it | Examples |
|---|---|---|
| What it does alone | Reversible actions with no effect outside the company | Filing a document, preparing minutes, updating an internal tracker |
| What it proposes | Actions prepared by the agent, approved and triggered by a human | An email to a client, a reminder, a reply to a supplier |
| What it never touches | Irreversible or high-stakes actions | A payment, a contract, sensitive data, a deletion |
Two questions sort an action into the right list: can it be undone, and does its effect leave the company? A reversible, internal action can be delegated. An irreversible action, or one a client will see, deserves a human.
These three lists are not written in the abstract. They are written process by process, from the process map: you then know which steps exist, who answers for them today and what a mistake costs at each one. It is the pattern AI proposes, deterministic logic disposes, applied to access rights: the agent’s technical permissions should then match these lists, not whatever the tool allows by default.
The takeaway
Agents with an identity are arriving, at Google and elsewhere, and they will be useful. The right question is not whether to let them in. It is what you entrust to them.
An agent without a job description is not a colleague. It is a risk with an email address.