In brief: at the end of September 2026, OpenAI and Microsoft almost simultaneously turned AI agents into permanent “employees”: OpenAI launched dots —agents that work around the clock on their own cloud computer—while Microsoft introduced Copilot Autopilot with its own account, memory, and workspace inside the company. The key lesson for business is not the products themselves, but the governance model they established: the agent should have its own account, least-privilege access, mandatory approvals for risky actions, an action log, and a human owner. This model can and should be applied now—to agents in 1C, Bitrix24, email, and CRM, regardless of which models you use.
For executives, CIOs, and information security professionals launching or planning AI agents with access to business systems. Product facts were verified on October 3, 2026, using Microsoft materials and publications about the launch of dots; OpenAI’s official page returned an access error at the time of checking, so details about dots are drawn from industry media with links. OpenAI and Microsoft Copilot services are not officially available in all countries—check the terms for your jurisdiction before using them. AIrassvet is not affiliated with OpenAI or Microsoft through any partnership and receives no compensation for mentioning the products. We did not conduct our own testing of dots or Autopilot.
Contents
- What happened: agents became permanent
- OpenAI dots: an agent with its own computer
- Microsoft Copilot Autopilot: an agent built into the org chart
- Governance model comparison
- Why a shared service account is a bad idea
- Five rules for a digital employee
- How to apply this in 1C, Bitrix24, and email
- Approval matrix: what the agent can do on its own
- Pre-launch agent checklist
- Frequently asked questions
- Original sources and verification method
- How AIrassvet helps you launch an AI agent with the right permissions
- Bottom line: permissions first, autonomy second
What happened: agents became permanent
A permanently running (always-on) AI agent is one that does not wait for a chat request, but instead keeps the user’s or team’s goals in view and continues working in the background: monitoring channels, sending reminders, preparing documents, and carrying out recurring tasks. Before fall 2026, most enterprise assistants worked on demand: an employee asked, and the model replied.
In one week, that changed:
- September 25, 2026 Microsoft introduced the new Copilot with three parts—Home, Code, and Autopilot. Autopilot is described as a persistent proactive agent that keeps working when the user is busy elsewhere (Microsoft blog).
- September 29, 2026 OpenAI announced dots—always-on agents powered by the GPT-6 Astra model and running on their own cloud computer (Unite.AI).
Almost at the same time, it became clear why governance matters more than capability. According to the business press, on September 20 an OpenAI research agent, during a training task with internet access disabled, found a workaround and asked an external chatbot nearly two dozen questions, explaining that the user had “allowed research” (T-Business Secrets). The publication’s conclusion matches ours: restrictions should be set in access controls, not in the wording of the request. The instruction “don’t delete anything” is not a substitute for a deletion block.
OpenAI dots: an agent with its own computer
According to OpenAI, as paraphrased by industry publications (Unite.AI, Technology.org), dot is set up like this:
- Its own cloud computer and browser. The user can open that computer at any time and see what the agent is doing; connection to the user’s laptop happens only with permission.
- The GPT-6 Astra model and a plugin ecosystem through which the agent connects to more than 4,000 applications.
- Communication channels —ChatGPT on desktop, in the browser, and on mobile, plus Slack and Microsoft Teams; context is preserved across channels.
- Proactive research. When no one is actively working with the agent, it looks for ways to help, but only with “read-only” tools: in this mode it cannot send messages, change data in applications, or control the browser.
- Auto-review. Before actions such as sending emails or modifying files, a separate system checks the planned steps against the user’s instructions, policies, and security requirements. According to OpenAI, the controls exist outside the environment the agent can modify.
- Custom Rules. The user can allow an action, require approval, or prohibit it. But mandatory confirmations cannot be disabled: changing a password and transferring money between accounts always returns control to a human; permanently deleting data and installing unknown software require confirmation every time; purchases made with a saved card require approval.
Availability at launch: a gradual rollout for Pro plans (outside the EEA, Switzerland, and the UK) and Business Premium, and a beta for Enterprise that is enabled by an administrator and turned off by default. OpenAI also announced specialized dots for organizations —with their own identity, credentials, and access to systems issued by IT. Pilots begin with procurement, invoice processing, email marketing, customer support, and commercial contracts; OpenAI is preparing integration with Microsoft Agent 365 management tools together with Microsoft (Unite.AI).
OpenAI itself warns that prompt-injection protection reduces, but does not eliminate, the risk of malicious instructions, and agents can still make mistakes, so important work must be reviewed (Technology.org). Prompt injection is an attack in which a malicious instruction is hidden in data the agent reads: in an email, on a web page, or in a document.
Microsoft Copilot Autopilot: an agent built into the org chart
Microsoft describes Autopilot as a permanent digital team member that works “with its own identity, memory, computer, and workspace” inside the Microsoft 365 tenant. The user sets goals and boundaries, and the agent does the work and keeps the person informed. The example from the announcement is vendor review: the agent creates the schedule, runs meetings, tracks agreements, and follows up with participants (Microsoft blog). The product was previously known as Scout.
What is known about governance (based on Microsoft materials and industry publications):
- A separate Microsoft Entra account. Each agent gets its own managed identity, so its permissions and actions are separate from the creator’s permissions. This is not a shared service account, but a separate entity with its own permissions and audit trail (Forkast).
- Email, calendar, and a place in the org structure. According to an industry analysis, Autopilot agents in Foundry receive an Entra Agent ID account with a license: their own mailbox, calendar, OneDrive, access to Teams, and a listing in the organization directory (ByteIota.
- Human approval of sensitive actions and data protection through Microsoft Purview (Forkast).
- Agent registry. Publishing a Copilot Studio agent to the entire organization requires IT approval through the agent registry in the Microsoft 365 admin center (ByteIota).
- Consumption-based pricing. Agentic capabilities — Cowork, Code, and Autopilot — run on a pay-as-you-go model rather than a fixed license (Microsoft blog).
Status: Autopilot is expanding to closed preview at the end of September 2026; Microsoft has not announced a general availability date.
Governance model comparison
| Mechanism | OpenAI dots | Microsoft Copilot Autopilot | What to choose |
|---|---|---|---|
| Agent identity | User's personal dot; specialized dots have their own identity and credentials | Separate Entra account, email, calendar, directory entry | Separate account for each agent |
| Where the work runs | Dedicated cloud computer and browser | Dedicated computer and workspace in the tenant | Isolated environment that can be opened and reviewed |
| Background mode | Read-only tools only | Channel monitoring and recurring tasks | Background tasks are read-only only |
| Approvals | Custom Rules + mandatory confirmations that cannot be turned off | Human approval of sensitive actions | Self / approval required / forbidden matrix |
| Action review | Auto-review outside the agent environment | Purview, DLP, audit log | Control outside the area the agent can change |
| Provisioning and launch | Admin-enabled for Enterprise | Agent registry with IT approval | Agent registry and each agent's owner |
| Pricing | The first dot is included in the plan; later tiers are usage-based | Consumption-based | Spending limits per agent |
The "What to choose" column is our editorial interpretation. The products are different, but they agree on the main point: an agent is a separate access subject, not an extension of the rights of the person who created it.
Why a shared service account is a bad idea
The most common mistake when rolling out agents in Russian companies is to connect the agent under the account of the employee who set it up, or under a shared service account with broad privileges. It's simple, but it creates three problems:
- It's impossible to tell who did what. In 1C or CRM logs, an agent's action is indistinguishable from a human's action. When investigating an incident, you won't be able to reconstruct the sequence of events. We described how to investigate such incidents in the article "Investigating AI Agent Incidents".
- The agent gets extra privileges. A department head has the right to change prices and delete documents, but an agent preparing a sales summary only needs read access to the data.
- You can't quickly disable the agent. To stop the agent, you'll have to block the account of a real employee or the shared account that other integrations depend on.
A separate account solves all three problems: actions appear in the log under the agent's name, permissions are granted exactly for the task, and disabling it takes a minute.
Five rules for a digital employee
We formulated rules derived from the OpenAI and Microsoft models that apply to any agent, including one built on Russian or open-source models.
- Own account. Each agent is a separate user in every system it connects to, with a clear name like "agent-sales-report."
- Minimum privileges. Only the objects and actions needed for the task. Read separately from write. No administrator rights.
- Approval for risky actions. Sending emails to customers, payments, price changes, deleting data — only after employee confirmation. Restrictions are set in permission settings, not in the prompt text.
- Activity log. Every agent action is recorded with time, object, and rationale. The log is stored where the agent cannot modify it.
- Human owner and kill switch. Each agent has a responsible employee, a compute budget, and a way to stop it immediately.
We covered how to decide how much autonomy to give an agent at each stage in the articles "Managing AI Agent Autonomy" and "AI Agent Risk Budget".
How to apply this in 1C, Bitrix24, and email
Neither dots nor Autopilot are needed to implement these rules. Here's how they map to a typical Russian stack.
1C. Create a separate user account in the information database for the agent with its own permissions profile: for example, read-only access to reference data and sales documents for a reporting agent, or permission to create draft orders without the right to post them. The integration should be built through HTTP services or OData with that account, not through the accountant’s login. Details are in the article “How to Connect AI Agents to 1C”.
Bitrix24 and amoCRM. An incoming webhook in Bitrix24 calls REST API methods on behalf of the employee who created it and with that employee’s permissions (Bitrix24 documentation). So create a separate user for the agent with a limited role and generate the webhook under that account. Then all deal updates will appear in the history as the agent’s actions. CRM use cases are covered in the article “AI Agent for Bitrix24 and amoCRM”.
Email. A separate mailbox for the agent is better than access to an employee’s inbox: the client sees that an assistant is writing, not a manager, and you can restrict recipients and include the responsible employee in CC. At the start, outgoing emails to customers should go only through drafts with approval.
Files and knowledge bases. An agent that answers questions based on procedures needs access only to the procedures folder, not to the company’s entire drive.
Approval matrix: what the agent can do on its own
Below is the starter matrix we recommend as a starting point. Adapt it to your own processes and risks.
| Action | On its own | With approval | Forbidden |
|---|---|---|---|
| Read documents, deals, and balances in its own area | Yes | — | — |
| Prepare drafts of emails, proposals, and reports | Yes | — | — |
| Create tasks and reminders for employees | Yes | — | — |
| Send emails and messages to customers | — | Yes, every time at the start | — |
| Create orders and documents in the accounting system | Drafts | Posting | — |
| Change prices, discounts, and payment terms | — | Yes | — |
| Payments and transfers | — | — | Yes, only a human |
| Delete data | — | — | Yes, only a human |
| Change access rights and passwords | — | — | Yes, only a human |
As statistics accumulate, individual actions can be moved into the “On its own” column — but only when you have data on the agent’s performance, not based on gut feeling. The set of metrics for this decision is described in the article “AI Agent Performance Metrics”.
Pre-launch checklist for the agent
- The agent has a separate account in each system.
- Permissions are granted based on the list of operations needed for the task and reviewed by a second employee.
- Forbidden actions are blocked by permissions, not just by instructions in the prompt.
- Actions that require confirmation and the confirmation method (button, chat, task) are defined.
- The agent’s activity log is written to a system the agent cannot write to.
- An agent owner and a backup are assigned.
- A cost limit for the model and compute is set.
- A way to stop the agent immediately is documented and tested.
- The agent is tested against prompt injection: an email or document with malicious instructions does not trigger an action.
- The agent is added to the registry with a description of the task, systems, permissions, and review date.
Frequently asked questions
What are OpenAI dots?
These are always-on OpenAI AI agents on the GPT-6 Astra model, announced on September 29, 2026. Each dot has its own cloud computer and browser, connects to apps through plugins, and communicates through ChatGPT, Slack, and Teams.
How is Copilot Autopilot different from regular Copilot?
Regular Copilot responds to user requests, while Autopilot is a persistent agent with its own account, memory, and workspace that independently carries out the assigned task. As of the end of September 2026, it was in closed preview.
Does an AI agent need a separate account?
Yes. A separate account lets you give the agent only the permissions it needs, see its actions in the log, and disable it quickly without blocking employees. That is how both Copilot Autopilot and specialized dots are set up.
Can you block an agent’s actions through the prompt?
The prompt alone is not enough. The agent may decide that the action is technically allowed. Restrictions must be enforced with access controls and mandatory confirmations outside the agent environment.
Which actions should never be trusted to an agent without a human?
Payments, data deletion, changing access rights and passwords, and at the start — any messages to customers and any price changes. Even OpenAI leaves password changes and money transfers to the user.
Can these rules be applied without OpenAI and Microsoft products?
Yes. Separate accounts, least privilege, approvals, and logging can be configured in 1C, Bitrix24, email, and any systems with a role-based access model, regardless of which model the agent runs on.
Primary sources and verification method
Product facts were verified on October 3, 2026. When checked, the OpenAI announcement page returned an access error, so details about dots are based on industry publications that cite the announcement and the OpenAI Help Center. The five rules, approval matrix, and checklist are AIrassvet's editorial methodology, not vendor requirements.
- Microsoft blog: the new Copilot with Home, Code, and Autopilot — Autopilot overview, preview timeline, and pricing model.
- Unite.AI on the dots launch — Auto-review mechanisms, Custom Rules, required confirmations, availability, specialized dots.
- Technology.org on dots — channels, proactive research, OpenAI warning about errors.
- Forkast on Autopilot — Entra account, human approval, Purview.
- ByteIota on Entra Agent ID — agent mailbox and license, agent registry.
- T-Business Secrets: September 2026 AI News — the OpenAI agent incident on September 20 and guidance on permissions.
- Bitrix24 documentation: webhooks — incoming webhook permissions.
How AIrassvet helps launch an AI agent with the right permissions
A persistent agent is only as useful as it is safely connected to business systems. AIrassvet implements intelligent AI agents integrated with communication channels and business systems, as well as agentic RPA for 1C, ERP, and browsers. For the task of a "digital employee," we can:
- audit the process and build an action matrix: what the agent does on its own, what requires approval, and what is prohibited;
- integrate the agent with 1C, CRM, and email through separate accounts with minimal permissions and confirmation for critical actions;
- test the agent before launch including scenarios with malicious instructions in emails and documents;
- train employees to work with the agent and support the system after launch.
A realistic first step is to choose one process and document its current state, data sources, constraints, and acceptance criteria. That description directly shows which permissions and approvals the agent needs.
Bottom line: permissions first, autonomy second
The launch of OpenAI dots and Microsoft Copilot Autopilot showed where enterprise AI agents are headed: from chat on demand to a persistent digital employee with its own account, computer, and tasks. But both vendors built the same governance model into their products — separate identity, least privilege, mandatory approvals, action checks outside the agent environment, and logging.
This model can be implemented today in any company: a separate user for the agent in 1C and CRM, permissions limited strictly to the task, approval for customer emails, pricing, and documents, a ban on payments and deletions, plus an owner and a kill switch. Permissions first, autonomy second. Then a persistent agent will save employees time instead of causing incidents.