Google gives Gemini agents their own email address, and decision models arrive
Google gives agents their own employee-style identity, a new class of one-pass decision models lands from OpenAI and Cloudflare, and Copilot's sandbox goes GA.
Three of today’s items are about the same quiet question: what does an agent get to touch, and who can tell afterwards? Identity, sandboxes and traces all turn up.
1 · Top story
Google gives its Gemini agent coworkers their own email address
At Gemini at Work 2026, Google Cloud introduced the Gemini agent, a single cloud-run agent that spawns temporary sub-agents and keeps context for hours or days. The part worth your attention is “coworker agents”: persistent agents with a defined role, their own @agents.company.com address, calendar, Drive and a directory entry, whose identity is stamped into logs and into any VM they start. Google says traffic goes through an Agent Sandbox and an Agent Gateway that enforces policy, and that it can route between Gemini and Claude models. Customers named include PayPal, Shopify and On; the page gives no pricing and no explicit preview or GA label for the agent itself (only the Financial Services and Legal specializations are labelled preview).
If you’re designing agent access, this is a reference for treating agents as principals with least-privilege roles, not as a user’s shadow. The open questions are the ones a vendor page can’t answer: how revocation works, and whether the audit trail is exportable to your SIEM. Ask for both before building on it.
2 · Models & features
Decision models: one forward pass, typed answers, no parsing
A small cluster of “decision” models arrived this month. OpenAI opened its Decisions API in public beta on October 6: POST /v1/decisions, running only on gpt-6-luna, returning predicate, choice or score answers with probabilities, at $0.10 per million input tokens and no output charge. OpenAI claims up to 10x faster than the same model through Responses, without a published workload. Cloudflare’s Clef (27B) and Clef-flash are the open-weight counterpart: Apache-2.0, post-trained from Qwen, no free text at all, with median latency of 38.8 ms for Clef-flash versus 209 ms for Clef on Workers AI. These are vendor figures on Cloudflare’s own Decision Index run, where Clef trails on GPQA and MMLU-Pro.
Routers, moderation gates and triage steps that today use a generative call plus a JSON parser are the obvious candidates. Take 200 labelled cases from your own traffic, run your current call against Decisions or Clef-flash, and compare accuracy, p95 latency and cost per 1,000 decisions. Check calibration too, because typed probabilities aren’t automatically trustworthy.
3 · Agents
Copilot’s local sandbox is generally available
GitHub says local sandboxing is now GA in Copilot CLI, the Copilot app and VS Code sessions using Agent Host, at no extra cost. The docs describe an OS-level sandbox: writes allowed in the working directory and temp folders, the rest of a Git repo read-only, no home directory, local network off, and placeholder credentials swapped for real ones by a local proxy only for approved HTTPS destinations. Enterprise managed settings can make it non-optional, so neither config nor --no-sandbox turns it off. Linux needs bubblewrap and slirp4netns; Windows needs recent 11 builds. Note that GitHub’s docs pages don’t yet say GA.
The caveats are the useful bit: tools needing HTTP/2, certificate pinning or request signing may break behind the proxy, and an approved one-command bypass skips credential masking. Pilot it on a repo where agents run builds, and count how many commands fail for sandbox reasons versus how many secrets never reach the process.
4 · Research
A preprint on watching what a long-running agent actually decided
“What Did the Agent Actually Do?” proposes the Evidence-Grounded Behavior Graph, a training-free way to group source-linked evidence into behaviors so a monitor can find consequential decisions and point to proof. The authors also introduce AgentMonBench, a software-engineering benchmark, and report gains across eight models in most settings. This is an arXiv preprint from 5 October, not peer reviewed, and the abstract gives no numbers or code link.
The idea fits an uncomfortable gap: reviewing a 300-step trace by hand doesn’t scale, and a monitor reading raw context misses things. Read the full paper for effect sizes before trusting it, then try the simplest version: have your monitor cite trace spans for each flagged decision, and measure how many flags a reviewer can confirm in under a minute.
5 · People worth following
Harrison Chase’s team on routing models inside the harness
LangChain argues the router belongs in the agent harness, not a generic gateway, because the harness knows the task. In Open SWE, a classifier picks one of three models on the first message of a thread. Over 973 threads against an always-top-model control, merged-PR rate was 29.2% versus 27.3% (p = 0.49, so no measurable difference), while median cost per thread fell from $2.61 to $0.94. A second test against a fast-only control was stopped after a day because engineers reported poor output.
Be careful with the headline: the control was the most expensive model, so much of the saving is overspend on easy tasks. Routing happens once per thread, so mid-thread changes (which would break prompt caching) are untouched. The router code is open source; label a week of your own traces by task type before copying anyone’s thresholds.
6 · Architecture
Cloudflare Traces puts the edge in your OpenTelemetry timeline
Cloudflare’s Traces is in open beta, reported by InfoQ on 10 October. It emits security rules, transforms, cache decisions, routing, Worker execution and origin handling as OpenTelemetry spans in one request timeline, with no instrumentation. In InfoQ’s example, 527 ms of a 539 ms request was origin time. A volume-based pricing change comes with it, and the report excerpt I could read doesn’t state the rates.
For agent traffic, the useful question is which hop ate the latency or blocked a tool call, and today that is stitched together from logs. Before adopting, check span volume against your request rate, because volume-based pricing on high-fanout agent traffic can surprise you.
Nothing here has to be decided today. Pick one and try it on Monday.
Middle East, India & events · 1
- TII’s Falcon-ASR, a 1.6B speech model for Emirati and Standard Arabic — Announced alongside Falcon-Emirati (7B) and Falcon-OCR-Arabic. TII says it also covers English, French, Spanish and Portuguese, returns word timestamps, and beats a 30B multimodal model on its internal Emirati test. Those are developer-reported figures; the press release gives no licence or release channel, so availability and terms are not confirmed. Source
Researched and drafted with AI, checked against the linked sources. How we use AI →