Google's Gemini agent: coworker agents get their own email, calendar and Drive

Google Cloud announced the Gemini agent on 8 October 2026, in a post by its chief executive, Thomas Kurian, adapted from his keynote at Gemini at Work 2026. Google describes it as a single, universal agent for work that answers questions, handles knowledge work, creates images and media, and writes and runs code. The user gives it an objective and comes back to finished work.

It runs in the cloud. Google says work that takes hours or days keeps running after you close your laptop, with one set of memories whichever device or channel you use. It is reachable on the web, on iOS and Android, on Windows and Mac desktops, and from the command line, Google Workspace, Microsoft 365 or Slack. It can also run with no interface of its own inside third-party applications.

The agent can create a roster of sub-agents for a multi-step job: temporary, job-specific agents, each with its own identity, working in parallel or in sequence. It connects to systems including Confluence, Jira, Salesforce, ServiceNow, BigQuery, Databricks, Snowflake and Postgres, and to any Model Context Protocol server inside or outside the company network.

The change for a buyer is where the work runs. An assistant that answers in a window stops when the window closes. An agent that runs in the provider's cloud for days is doing work nobody is watching, on the organisation's systems, under permissions somebody granted. That moves the question from how good the answers are to what the agent was allowed to reach and who checks the result.

The channel list matters for a mixed estate. An organisation whose documents live in Microsoft 365 and whose chat is Slack can still be reached by this agent, according to Google's post. That can make it a candidate in estates that are not Google Workspace customers, and it also means a second vendor's agent may be acting inside tools the first vendor's admin console governs.

The connector list is long and includes any MCP server. Each connection is a grant of access. The useful discipline is the same as for a new member of staff: start with the least access the job needs and add to it on evidence.

A user can create a coworker agent by describing the role. Google says the agent receives its own Workspace account, including an email address, calendar, Drive and a presence in the company directory. Colleagues work with it as they would with a person, by adding it to a Chat space or @mentioning it, or by tagging it in a document comment, where it can suggest an edit and reply in the thread. Its edits appear under its own name in version history.

Google describes coworker agents as having a persistent, defined role across days and sessions, dedicated identities including their own @agents.company.com email addresses, and their own persistent storage. A coworker agent acts under its own identity, and Google says it sees only what you share with it: access follows the sharing and membership a team already uses.

This is a new kind of record in the directory. A person has a manager, a contract, a start date and a leaving process. A coworker agent created from a one-line description has a mailbox, a calendar and a Drive, and Google's post does not say who owns it when its creator changes role or leaves. Organisations with a joiner, mover and leaver process for people will likely need the same three steps for agents.

Sharing is the control, which makes existing sharing habits the risk. An agent that sees only what is shared with it is as well contained as the Chat spaces and shared drives it is added to. Where those are broad, the agent's reach is broad. This is the same permissions problem that assistants searching a whole tenant exposed, arriving by a different route.

An agent with an email address can receive mail. Whether people outside the organisation can write to it, and what it does with instructions that arrive that way, is a security question to settle before the first one is created. Google's post does not address it.

The separate identity is also the useful part. Actions attributed to the agent, in version history and in logs, are easier to review than actions an assistant took in a person's name.

Google says every agent gets its own identity, cryptographically attested and governed like an employee, with least-privilege permissions. Security administrators approve fine-grained, role-based access. Every action is written to an audit trail and attributed to the agent, and where the agent connects to an external system its identity is passed on through standards such as OAuth.

All Gemini agents run tasks inside an Agent Sandbox with its own network boundary. All traffic in, out and between agents passes through Agent Gateway, which Google describes as an AI network firewall that enforces the organisation's policies in real time. A policy is written once, with Google's example being that agents may not open documents classified Need to Know, and applied to every agent.

The model is a separate choice from the agent. Google says the agent runs each job on the model that fits, across its Gemini family and Claude models from Anthropic today, with other private and open models to follow, and that a routing tool sends each workload to the model that gives the performance needed at the lowest cost.

On cost, an administrator can set a hard limit on a project's AI spend in the Cloud Billing Console. Gemini monitors token usage and sandbox costs, and if the cap is reached that project's agent pauses until someone resumes it in the console. Spend is tracked by project so it can be charged back to departments.

These are the right headings: who the agent is, what it may do, what it did and what it must never touch. They are also described in a keynote, with no documentation linked for how each is configured. A named control is a starting point for a test plan and should be treated as that until it has been tried in your own tenant.

A hard spend cap that pauses the agent is a useful control on metered AI. It has a second edge: a cap that pauses work in the middle of a long job needs an owner who is told and a decision about what resumes. Set caps by project and rehearse hitting one.

Routing across two labs' models can lower cost and raise quality on hard jobs. It also means a prompt may be processed by a model from a second provider. Google's post does not say where that processing happens or on what data terms, so a buyer with residency or confidentiality requirements has a question to put in writing.