Google gives Gemini agents personal emails, calendars, and directory listings

A full package for AI agents

Google has launched a new generation of Gemini-based AI agents that receive full corporate-employee status. Each agent gets a Workspace account, a personal email address, a calendar, Drive access, and an entry in the company directory. Critically, the agent operates under its own identity rather than impersonating a human.

Each agent is issued a cryptographically verified identity, which is recorded in logs and in the virtual machines it runs on — as Thomas Kurian, CEO of Google Cloud, explained. Administrators approve permissions based on roles. All traffic passes through an AI network firewall, which Google positions as a protective layer.

The agent works as a built-in tool across: • Gmail • Drive, Docs, Sheets, Slides • Chat • Calendar • Microsoft 365 • Slack

Tasks are routed to both Google's own models and Anthropic's Claude. The key difference: the agent can keep working for hours or days even after the operator closes their laptop.

The key point: a separate audit trail

All actions are logged under the agent's own name, not a human's. This is the first time Google has given an AI system a full employee "badge" (the company launched its agent platform back in April, but this marks the first serious step toward integration into corporate workspaces).

The timing is no coincidence. Just hours before Google's announcement, the UK's Information Commissioner's Office (ICO) said it had secured data-protection policy changes from Google and nine other developers. In parallel, the ICO opened a public call for evidence on AI agent risks, with a deadline of November 20. Richard Nevinson, director of technology regulation at the ICO, made the position explicit: agent autonomy is not an excuse for poor regulatory compliance.

A market-wide control problem

The AI agent industry is accelerating, but governance is lagging behind. NeuralTrust (Barcelona) monitored agent sprawl at large organizations and found that, on average, 1.2% of all daily agent interactions are malicious. Gartner analysts forecast that by 2027, 40% of corporations will pull back autonomous agents specifically because of gaps in management and oversight.

Google is responding to this in some way — the announcement names Deutsche Telekom as a European customer requiring data sovereignty. However, Google did not name specific regions, did not publish pricing, and did not announce general availability.

Regulatory hurdles ahead

The European Commission is working on a Cloud and AI Development Act that would require sensitive public-sector workloads to be owned and controlled by organizations within the EU. Google Cloud, in its current form, cannot guarantee that.

One notable gap: Google's official documentation describes in detail how an administrator grants an agent permissions via OAuth and limits its spending. But it does not explain how those permissions can later be revoked, or how to fully deactivate an agent — a point that could become a pain point under regulatory scrutiny.