A workplace agent needs its own identity lifecycle

Google Cloud introduced a Gemini workplace agent on 8 October, describing multistep work across enterprise applications under a dedicated identity. Reuters reported that the launch intensifies competition over enterprise agents, while The Verge focused on the agent’s ability to act across business tools.

Build a machine-worker lifecycle

Before enabling write access, assign an accountable owner, a narrow purpose and an expiry date. Record which data domains the agent may read, which actions need human approval and which systems must never accept autonomous writes. Provision the identity through the same ticketed path used for privileged service accounts, but add task-level logs that let reviewers reconstruct why an action occurred.

A role change should trigger re-authorisation rather than silent inheritance. When a team, vendor or workflow changes, recertify connectors and remove stale scopes. Offboarding needs to revoke tokens, scheduled tasks, delegated credentials and cached context together; disabling a visible interface alone may leave downstream access intact. Run one tabletop exercise for a compromised agent identity and one for an agent that follows an incorrect but authorised instruction.

The announcement describes intended capabilities, not independent evidence of accuracy, control effectiveness or business outcomes. Product architecture may also change before broad availability. A dedicated identity can improve attribution, yet it does not prove that permissions are least-privilege or that approval steps are meaningful. Pair the identity lifecycle with a delegation register, using the control pattern in OpenAI dots a delegation register. Measure orphaned credentials, scope exceptions, approval latency and the percentage of high-impact actions that can be replayed from logs.