On 8 October 2026 Google used its Gemini at Work event to describe an enterprise agent that takes an objective, plans multi-step work and creates sub-agents of its own. The governance detail around that agent is the part teams will have to live with: a corporate account for the agent, an audit trail written against the agent’s identity, policy enforcement that spans every agent, and a spend cap that can stop one. Google’s name for the product is a “universal agent for work”, one of several coinages of its own.

Thomas Kurian, Google Cloud’s chief executive, opened his post with the problem those controls answer: “Two factors determine whether an enterprise agent program succeeds or stalls: whether you can govern it, and whether you can afford it.”

Two caveats shape what follows. Google’s post attaches no release status to the agent or its governance features; preview, shipped and general availability are all unstated, and none of them appear in the Gemini Enterprise release notes for 8 October 2026 or in product documentation last updated on 7 October. Every customer and scale figure here is vendor-supplied and unaudited.

The agent gets its own Workspace account

Kurian describes identity as a first-class object: “Every agent gets its own identity, cryptographically attested and governed like an employee, with least-privilege permissions. That identity is stamped into the logs that capture its work, and into any virtual machine spun up to run code on its behalf.”

Google calls the persistent version a “coworker agent”, a term of its own rather than an industry standard. The post says the agent “receives its own Workspace account, including an email address, calendar, Drive, and presence in your company directory”, with addresses on an @agents.company.com domain, another Google coinage. Sub-agents are “temporary, job-specific agents, each with their own identity”, created per task.

Permissions are granted per agent and are meant to be approved by security administrators. When the agent reaches into an external system, the post says its identity “is mapped and propagated through industry standards such as OAuth”. Whether every downstream system records the agent instead of a person or a shared service account is not stated, which leaves part of the attribution promise outside Google’s control.

Every action is logged under the agent’s name

The attribution rule is explicit: “every action Gemini takes is written to an audit trail and attributed to the agent rather than to a person”. Google adds that because the identity travels into any virtual machine the agent starts, administrators can follow those logs in real time with Google’s observability tools and “catch anomalous behavior before it matters”.

Where those entries land and how long they survive is not in the post. Google’s documentation for Gemini Enterprise usage audit logs does record agent fields, including an agent SPIFFE identifier, which fits the cryptographic attestation claim without proving it. Turning audit logging on requires the Gemini Enterprise Admin role and reading the logs requires the Logs Viewer role; prompt and response content is stored only when an administrator turns on prompt and response logging. Cloud Logging buckets retain data for 30 days by default, configurable up to 3,650 days. None of those numbers is stated as the retention for the agent’s own audit trail.

One policy written once, enforced across every agent

Google’s answer to policy sprawl is a component it calls “Agent Gateway”. All traffic “in, out, and between agents” passes through it, according to the post, and it is “an AI network firewall enforcing your organization’s policies in real time”. Kurian gives the example policy “agents may not open documents classified Need to Know”, and says Gemini “applies it to every agent in your company instead of checking one agent at a time”. The post also says: “All Gemini agents execute tasks safely inside an Agent Sandbox with its own network boundary.”

That scope claim rests on Google alone: no non-vendor corroboration of Agent Gateway or its enforcement turned up in the sources checked, and third-party write-ups repeat the announcement rather than test it.

The spend cap and who can set it

The cost control is the most concrete item, and Google’s administrator documentation fills in mechanics the announcement leaves out. From the post: “You can set a hard limit on a project’s AI spend in the Cloud Billing Console, and Gemini enforces it.” Google says Gemini monitors token usage and sandbox costs, and that “if a spend cap is triggered, that project’s agent pauses, and you can choose to resume work with a single click in the console.”

The administrator guide adds who does this. A Gemini Enterprise Administrator enables overages and sets the monthly spend limit, using a Cloud Billing budget scoped to the Vertex AI service, because Gemini Enterprise overages are billed under the Vertex AI API. It requires an invoiced Cloud Billing account and an active subscription, and it carries an operational limit: “Because stopping usage can take a few minutes to take effect, you might incur charges that exceed your limit.”

A capped agent keeps spending for those minutes. The post’s chargeback claim, that companies can bill AI costs to specific departments, follows from the cap being tracked per project.

What is new on 8 October and what Google had already announced

Google has described pieces of this stack before, as its own monthly roundup shows. Agent Gateway appeared in the April 2026 Next ’26 recap, where Model Armor was said to integrate with it alongside new “Agent Identities”. Agent identity returned in July 2026. Long-running agents working in “secure cloud sandboxes” were an April 2026 item, and cost controls for agents arrived in August 2026. What 8 October adds, on this evidence, is the Workspace account with directory presence, per-action attribution, company-wide policy scope, and the pause-and-resume behaviour of the cap.

Model routing sits in the same category. Google says the agent runs “each job on the model that fits best”, across its Gemini models “and Claude models from Anthropic today”. The only documentation found for third-party models is the 8 October AI developer tools note, which covers enabling Claude Opus 5.5 and Sonnet 5.5 in Antigravity through an in-console consent flow, off by default and limited to global, us and eu locations. Routing inside the agent itself remains announcement-level.

The post also repeats a hardware claim from April: that the “latest TPU 8i system delivers 80% better price-performance than the prior generation”, which matches what Google said at Next ’26.

Where the numbers come from

Google lists customers with figures that originate with the vendor and have not been independently audited: BNP Paribas, available to more than 65,000 employees; Orange Spain, deploying more than 1,000 custom agents; SOMPO, over 10,000 agents across 34,000 employees; Tata Steel, more than 300 specialized agents in nine months; and PayPal, routing 10 million multi-model requests a week. The outcomes attached to them, including Tata Steel cutting complaint turnaround by 50% and Ulta Beauty tripling its digital sales conversion rate, are Google’s own, and the post does not separate audited results from customer expectations.

The reach framing comes from the keynote rather than the post. TechCrunch reported Sundar Pichai saying “Gemini today has over 1 billion monthly active users” and that “nearly 90% of Fortune 100 businesses now use Gemini Enterprise at work”. Google’s post carries the Fortune 100 figure and not the 1 billion one. Both are unaudited.

What Google’s post does not say

Retention is one absence among several that administrators would ask about first. There is no region list for the agent or its governance features. There is no pricing for the agent, per agent, per seat or per token. There is no general availability date, and Google says it will bring the agent to businesses before consumers. The post does not describe admin consent screens, user-level consent, or how an organisation decommissions or revokes an agent. Whether a licence edition, Workspace prerequisites or an invoiced billing account are needed for the agent itself goes unstated, although the overage documentation shows such conditions exist for the cost controls.

Only one part of the announcement carries a status label, and it is not the governance layer: the Financial Services and Legal industry specialisations are “now in preview”, with Government, Healthcare and Retail “coming soon”.

How this differs from the Copilot reporting gap

Our coverage of Microsoft’s Copilot reporting gap described administrators who could not see agent activity in their usage reports. Google’s post is a vendor describing an architecture that is supposed to produce that visibility. The open question there was whether a report reflected reality; the question here is whether the governance layer exists in the product at all.

Practical reading: the identity, audit and policy controls are described in an announcement and are absent from the documentation an administrator would use today, so they are worth watching in the release notes and the Gemini Enterprise console before a deployment plan depends on them. The spend controls are the exception, since project spend limits and spend cap budgets are documented Cloud Billing and Gemini Enterprise features now.