Google vs. Microsoft: Who really controls enterprise AI agents?
Google offers a universal agent for delegated work, while Microsoft emphasizes governance across many agents. Both visions overlap and require proof beyond vendor announcements.
Google Cloud unveiled a universal Gemini work agent on October 8, 2026. Microsoft explained identity, scoped authority and continual containment across agents on October 19. These are different emphases, not independent evidence that either system is safer.
Evidence and limits
- Google launch
Universal work agent
Vendor documentation; availability and effectiveness require verification.
- Microsoft strategy
Independent governance boundary
Vendor documentation; availability and effectiveness require verification.
Google and Microsoft compared
| Dimension | Microsoft | |
|---|---|---|
| Perspective | A universal work agent | Agent identity and control |
| Work execution | Persistent delegation and subagents | Governance across many runtimes |
| Identity | Personal and coworker agents | Independent agent identity and owner |
| Evidence | Vendor claims; test actual access | Vendor claims; test enforcement |
Vendor-described approaches, not a certified security comparison or availability guarantee.
Two strategies, one question of authority
The challenge for enterprise AI is no longer simply finding the model that writes the best answer. Agents can access documents, execute code and alter business records. Organizations therefore need to know who authorized an action, which permissions applied and how a mistake can be contained.
Google and Microsoft approach this shift with different leading messages. Google emphasizes a universal work-performing agent. Microsoft's recent security publications emphasize identities, agent inventory and controls across multiple agents. Both perspectives are essential; neither is an independently verified safety verdict.
Google: Delegate outcomes to one work agent
Google Cloud introduced the Gemini agent on October 8. The company describes a system that accepts goals, plans work, invokes tools and connects to approved enterprise systems. Shared context and cloud execution are intended to carry tasks across devices and sessions.
Google distinguishes temporary subagents from persistent coworker agents with their own identities and storage. It also describes model routing and enterprise controls. These are product claims whose real availability and reliability require verification in the relevant organization.
Microsoft: Agents need accountable identities
Microsoft treats agents as operational actors within enterprise IT. Agent 365, Entra Agent ID and Project Perception seek to discover agents, associate them with owners, inspect access and apply bounded authorization.
In its October 19 publication Microsoft describes task-specific, time-limited permissions and measures that can restrict access as risk changes. Instructions embedded in a hostile document should not grant an agent new powers. The security boundary must exist outside the model's own judgment.
More than a simple safety-versus-productivity contest
Google also describes policy, identities, sandboxes and spending limits. Microsoft also builds assistants and agents that do productive work. It would be misleading to frame one vendor as functional and the other as solely protective.
Google starts with the worker delegating an objective; Microsoft starts with the enterprise managing a fleet of agents. Buyers need both a useful workflow and enforceable control in their actual environment.
An invoice approval pilot reveals the stakes
Imagine an agent reviewing invoices, matching purchase orders and preparing approval. A productivity test asks whether the agent assembles accurate information. A control test asks whether it can replace bank details or execute payment without authorization.
A proper pilot includes manipulated PDFs, expiring credentials, revoked permissions and deliberately forbidden actions. Correctly blocked operations matter as much as successful tasks. AgentenCode has not performed such an independent test for the products discussed here.
Identity does not equal permission
A separate agent identity improves accountability, but does not prove the attached permissions are appropriate. Agents may combine multiple connectors and delegated accounts, potentially expanding their effective reach.
Least-privilege access, short-lived authorization, human approval, logging and reliable revocation all matter. Prompt injection and unintended transfers are particularly hard to manage when a model can recommend plausible but unsafe steps.
Pricing, access and data residency remain open
Google advertises model choice and spend controls; Microsoft emphasizes governance and security services. A meaningful price comparison requires concrete subscriptions, regions and measured workflows. Tokens are just one cost alongside runtime, storage, integrations and monitoring.
European buyers must inspect processing regions, contractual terms, retention, audit logs and third-party model routing feature by feature. We cannot infer blanket EU hosting, certification or universal availability from these announcements.
Five checks before a real rollout
A credible evaluation produces an inventory with accountable owners, evidence of task-specific permissions, traceable tool and data access, a tested mid-run revocation and reproducible total cost. Quality matters too: results should be repeatable, reviewable and reversible.
Agents also need to handle ambiguous instructions, missing data and failed connections. A long feature list or polished demonstration does not establish that these difficult cases are solved.
Four independent layers of an agent architecture
A useful comparison separates enterprise agents into four layers. The model proposes the next step. The orchestration layer coordinates tasks and subagents. Tools connect the workflow to real business systems. Independent authorization determines which actions may actually execute. Marketing frequently bundles these layers under one product name, making it harder to identify where a real control exists.
Google's announcement foregrounds orchestration and a consistent place to delegate work. Microsoft's security story puts particular weight on identity, risk and enforcement outside the model. This is an editorial way of organizing their published priorities, not a claim that either vendor has omitted the other layers. Procurement teams should demand evidence for all four.
When agents delegate to other agents
Multi-agent work creates a difficult question of responsibility. A primary agent may delegate research, a second may execute a tool and a third may assemble an outcome. Which identity authorized each step? Can the second agent inherit rights that were intended only for the first? Who preserves the trace linking a decision to the data and instructions behind it?
Google describes distinct identities for subagents. Microsoft emphasizes separate identity and task-scoped authority. But the real test is whether delegation can silently expand privileges. Buyers should be able to audit the full chain of tasks, data access and permission decisions across all participating components.
Prompt injection: when source content becomes a false instruction
A malicious instruction may be disguised as a note in a supplier PDF, a comment in a repository or a request allegedly sent by a manager. An agent might encounter it while completing an otherwise legitimate assignment. The failure begins when untrusted task data is promoted into authority over the agent's actions.
System prompts and model benchmarks are not enough on their own. Enforcement should block untrusted content from granting permissions, sending sensitive records elsewhere or bypassing a required human approval. A convincing evaluation would include repeatable negative tests and identify the technical enforcement point that stopped each forbidden action.
Interoperability, lock-in and reversal
A universal work interface raises an architectural question: how easily can organizations move the workflow to another supplier? Models may be swappable while memory, connectors, policies, identities and audit trails remain tied to proprietary services. A cross-agent governance system can introduce dependencies of its own.
A meaningful portability test exports configuration, documents standards and restores a working flow in a second environment. Operators should also be able to stop a task after failure, reconstruct a trusted checkpoint and reverse an unwanted change. Interoperability needs practical evidence, not just references to open protocols.
A measured rollout beats an enterprise-wide launch
Start with one low-risk workflow using synthetic records. Define approved tools, data classes, spending limits, accountable owners and mandatory approvals. Deliberately test conflicting instructions, unavailable connectors, expired credentials and unexpected data access. Count and explain failures as carefully as completed tasks.
Only then add other systems and subagents. Each integration changes the effective authority of the workflow and may invalidate an earlier risk assessment. Finance, HR and customer records require particularly careful attribution, revocation and human oversight. None of the vendor announcements demonstrates that these steps have been independently completed for every buyer.
Our assessment: Combine useful autonomy with enforceable limits
Google's unified work agent addresses fragmentation across tools. Microsoft's approach highlights the operational reality of managing agents from many sources. Both are useful directions; both demand evidence beyond vendor materials.
We would judge enterprise agents by task quality, source transparency, scoped authority, independent controls and honest cost accounting. No independent winner on security or availability can be established from the primary-source announcements alone.
Frequently asked questions
Is Microsoft demonstrably safer?
No. Vendor statements are not independently reproduced, comparable security tests.
How do Gemini agent and Agent 365 differ?
Google describes a work-performing agent; Microsoft Agent 365 mainly emphasizes governance across diverse agents.
Can Google use different AI models?
Google describes model routing, subject to the specific product and customer access.
How should a company start?
With a narrowly scoped workflow, test data, documented rights, negative tests and human approval.
Original sources and evidence boundaries
Primary vendor publications; no independent certification, tenant security audit or universal cost claim.