AI Agents Leave Their App: The Access Question Becomes the CEO's Business

In the last few days, something qualitatively new has happened: AI agents are no longer staying inside their vendor's application. Instead, they are moving into the tools you already use every day. Salesforce is bringing its Agentforce Coworker into Microsoft Teams, Adobe is connecting its CX Enterprise Coworker with ChatGPT and Claude, and Box is launching Architect, an agent-building platform with protection against agent attacks. For you as a decision-maker in Switzerland, this shifts the central question from tool purchasing to access and governance control.

What happened this week: Three announcements, one pattern

On November 5, Salesforce announced that Agentforce Coworker would launch in Microsoft Teams, as an iOS app and as a desktop app for Mac and Windows within the same month. The new license costs USD 50 per user per month. The assistant works directly in the Teams chat, accepts tasks, uses the user's Salesforce permissions, distributes work to other Agentforce agents, and pulls in emails, calendars and files through new connections to Google Workspace and Microsoft 365.

A day earlier, Adobe had linked its CX Enterprise Coworker for marketing teams as a plugin with ChatGPT, Anthropic Claude, Databricks Genie, Google Gemini for Business and Microsoft Copilot. Amazon Q, IBM and Snowflake are expected to follow. In parallel, Box announced at its BoxWorks conference the new Architect platform, which lets companies deploy agents across their files and tools, complemented by security controls and threat detection specifically against agent attacks such as massive data exfiltration or user account takeover. The new security logic works with existing access permissions.

Adding to the picture: Workday introduced 17 AI agents and a new Workday Home, Perplexity launched 'always-on' teammates, Smartsheet announced the vsActual platform with its Execution Graph and specialised agents, and Tana is bringing agents directly into ongoing Zoom and Teams meetings. The pattern is clear: the agent is transforming from a product feature into an 'employee' that follows you into every tool you already use.

The real decision problem is no longer 'which AI?' but 'who has access?'

Until now, the question for Swiss companies was relatively simple: which AI platform do we buy, and where do we integrate it? That question is losing relevance. Because when every vendor pushes its agent directly into Microsoft Teams, ChatGPT or your file storage, you no longer decide about tools; you decide about access.

Concretely: each of these agents wants access to your emails, your calendar, your CRM and your documents to execute tasks. That is exactly why you buy them. But many independent agents mean many opaque access points, and that is where the governance problem arises. It is telling that even vendors classify this as a real threat: Box has launched a security product against this attack vector. That is the clearest indication that this risk is not theoretical.

Three levers to maintain control

You don't have to prevent access; that would be unrealistic. But you can lead it. Three concrete levers matter:

1. Keep a single control point: a central orchestration layer that manages all agents, instead of granting separate access to every vendor. That is the difference between an orderly team and a band of individuals each accessing your data on their own.
2. Apply the least-privilege principle: each agent gets only the data its task concretely requires. Nothing more, nothing less. This applies to Salesforce just as much as to Adobe or Box.
3. Consider AI outsourcing: orchestration and access control can be procured as a service. This prevents five agent licenses being activated uncoordinatedly.

What this means for Swiss companies in practice

For Swiss companies, there is an additional dimension: legal responsibility. The revised Federal Act on Data Protection (revDSG) requires clear accountability for handling personal data. If an agent from Salesforce or Adobe gets access to your customer data in Microsoft 365, that is data processing for which you are responsible. You need not only technical oversight, but also documentary evidence: who can access which data when, and how is that logged.

Another aspect is integration into the Swiss system landscape. Many mid-sized companies work with Abacus, Bexio or Microsoft 365. If the new agents orient themselves exclusively towards the major US platforms, connecting to Swiss ERP systems could become a challenge. Companies that define a clear integration and orchestration strategy early will avoid later patchwork solutions.

The good news: those who engage with orchestration early gain a real advantage. The vendors themselves have recognised that the future is agent-spanning. If you do the same at the enterprise level, that is, controlling access centrally, you are no longer the driven party, but the leader. In this sense, it is worth looking at the complete agent stack from Oracle and IBM, which shows how vendors bundle their agents AI agents built in: Oracle and IBM deliver the complete agent stack.

Governance is not an option, it's the new duty

This week shows that agents are becoming a standard feature, similar to the cloud or mobile computing in earlier times. Those who ignore it will be overtaken by the development. Those who actively shape it can fundamentally improve their processes. The question is only whether you build governance now or later, under time pressure. Because once agents are working in your systems, retrospective control becomes significantly more complex.

This is not only about security in the narrow sense, but about control in the broader sense. How many agents may a team use simultaneously? Who is allowed to activate new agents? How are their decisions documented transparently? These questions cannot be answered by a single tool, but require an overarching strategy. The governance gap that already emerged when agents became a standard feature is now becoming even larger AI agents as standard feature: Why the governance gap must be closed now.

Practical tip: how to start this week

The first step is not a pilot project but an inventory. Get an overview of which agents are already active in your company, which data they access and who administers them. This sounds unspectacular, but it is the foundation for any governance decision. Many Swiss companies lack this overview because agents were often introduced bottom-up AI agents are here, the processes are not: Three gaps for Swiss companies.

In a second step, define clear rules: who may introduce new agents? Which data classes are off-limits for agents? How are access rights logged? The answers matter more than any tool purchase. And if you realise you lack the personnel for this task, that is exactly the moment to consider external orchestration. Podcast interviews with AI practitioners show that agent governance must happen before deployment, not after Why AI pilot projects die in 2026 and companies must now scale.

Conclusion: The agent follows you, not the other way around

This week's news is more than a product update. It marks the transition from AI as an app to AI as a constant companion. The agent works where you already work. That is a gain in convenience, but also a gain in responsibility. The good news: it is solvable. Those who lead access instead of merely managing it regain control. And those who achieve orchestration without building a dedicated team gain a real competitive advantage in a world where every company suddenly employs dozens of agents.

The decision lies with you. You can wait until every employee activates their own agent licenses. Or you take the lead and define now who gets which access in your company. The difference between these two paths is the entire governance architecture of your firm. For more background on why vendors don't build moats and what that means for your strategy, read our analysis of the Anthropic IPO No moats for AI vendors: The Anthropic IPO and your SME.

Frequently asked questions

What is the difference between a chatbot and an AI agent?

A chatbot answers questions. An AI agent executes tasks autonomously: it plans, uses tools, accesses data and works across multiple systems. The current announcements from Salesforce, Adobe and Box point exactly in this direction: the agent becomes an active force in your IT landscape.

Do agents in Teams and ChatGPT cost extra?

Salesforce charges USD 50 per user per month for Agentforce Coworker. Adobe and Box have not published prices for their agent solutions. Prices depend heavily on integration and the data sources required. It is worth including the cost of orchestration and control in your calculation, not just the license fees.

How do I protect my company from agent attacks?

The central measure is enforcing the least-privilege principle: each agent gets only the data it needs for its task. In addition, central access controls, audit logs and regular reviews of permissions are essential. Box has shown with its new security feature that vendors take such risks seriously. As a company, you should do the same.

Do I need my own AI team to control the new agents?

Not necessarily. You can also procure orchestration and control as a service. This is particularly attractive for SMEs because you become operational faster without having to build long-term staff. Experience shows that agent governance should be clarified before deployment, that is, before the first licenses are activated.

How does data processing under revDSG work when an agent accesses Microsoft 365?

When an agent from Salesforce or Adobe accesses data in Microsoft 365, that is data processing under the revDSG. As a company, you are responsible for this processing and must ensure it complies with legal requirements. This includes a legal basis, transparent information for affected individuals, and compliance with data processing agreement rules.