Before It's Obvious: In Its Own Name

The one-paragraph version

Last week, the machinery for running AI agents arrived. This week, agents started getting names of their own. On 7 and 8 October, three companies that weren't working together did the same thing at three different layers. Google introduced a Gemini agent that can join a team with its own work account and email address, and whose edits show up under its own name. Microsoft made containers that seal agents off from the rest of a computer generally available, and on Windows 11 they can run an agent under its own account. Apollo GraphQL launched a service that gives agents their own controlled access to company systems, with Intuit piloting it. Meanwhile, TikTok began testing an AI shopping assistant and one-click checkout inside the app where creators already sell. Google opened a tool that turns typed descriptions into playable games. And the White House announced over $100 million more for laboratories that software can run. The question is shifting from what may an agent do? to who did it, who gets the credit, and who pays?

Where we left off

Our first two episodes tracked ten signals. In one line each:

1. Agentic commerce: AI agents are starting to shop and pay on people's behalf, and the rules are being written now.
2. Conversational advertising: ads have moved inside AI chat, and Amazon Ads now sells ads in ChatGPT.
3. People supervising software: large employers are reorganising work around people who direct and check AI agents.
4. Physical AI: humanoid robots are logging real hours in factories and warehouses.
5. AI builds the shortlist, people supply the trust: shoppers let AI narrow the options, then look to reviews and creators.
6. The agent control plane: products for controlling what agents may touch, what they did, what they remember and what they cost.
7. Small software: describe an app in plain words and have it built.
8. AI shopping changes what people buy: most AI shoppers have switched brands because of a chatbot, but almost all still check the proof.
9. Smart glasses: splitting into a family of devices, including one with no camera.
10. Spatial intelligence: models that understand 3D space, worth $8.2 billion to AMD.

What changed since last week

The agent control plane moved the most, again. Last week it became a product category. This week it got the first thing any new worker needs: a name.

How the five connect

Last week we followed one agent through a working day. This week, follow one question: who did that?

An agent joins a team under its own name→it reaches company systems through its own controlled pass, not a person's password→everything it does is recorded against that name→inside a shopping app, an assistant does the same for buyers: shortlist, creator proof, checkout→and "describe it and it happens" spreads to games and laboratories

• Agent identity is the name badge that makes every other control possible.
• TikTok's tests show the shopping journey being rebuilt inside one feed, with an agent in the middle.
• Gen Z's habits show why brands have to be chosen again each time, which agents will make easier.
• Prompted games show the "describe it" pattern reaching play, not just work.
• Programmable labs show it reaching the physical world.

The same word sits under all five: attribution. Which agent did this, and for whom. Which creator's video made the sale. Whether a brand gets credit for past loyalty, or has to win the shopper again. Who owns a game made from a prompt. And who owns the results of an experiment run on someone else's equipment.

The five signals

1. Agents are getting their own names

What happened. On 8 October, Google introduced the Gemini agent, now in private preview. When a team sets it up as a "coworker agent", it gets its own Workspace account, email address and entry in the company directory. Its edits show up "under its own name in version history", and its actions are recorded as the agent's, not a person's. The day before, Microsoft made its Execution Containers generally available on Windows, Mac and Linux. They use rules to limit which files, network addresses and resources an agent can reach. On Windows 11, they can run an agent under its own Windows account, separate from the person using the computer. Also on 7 October, Apollo GraphQL, whose software connects companies' apps to their data, launched Agent Services in public preview. Agents get their own controlled pass, so they "never hold upstream credentials". Access can be limited down to individual items of data, and every request is logged. Intuit is piloting it.

Why it matters. Last week the controls around agents became a product category. This week shows what sits at the centre of it: the agent's own identity. You can't limit, log or cost something you can't tell apart from a person. Three companies did this at three different layers (the office suite, the operating system and the connections between systems) in the same week, without coordinating.

Why it might be noise. Some of this is existing identity and security products with a new label. Google's agent is in private preview and Apollo's is in public preview. Microsoft's pieces for telling an agent's activity apart from a person's, and for managing these agents centrally, are only "coming soon". And there's no data yet on what any of it saves or prevents.

What it means for brands. Before any campaign or brand workflow uses agents at scale, someone will ask: which agent did this, for whom, under what permission, and what did it cost? Have an answer ready.

Beyond advertising. Agents may become named members of teams, budgets and org charts, the way cloud accounts once did.

2. TikTok is building shopping into the feed

What happened. At Advertising Week New York on 5 October, TikTok announced three AI products for shopping and sales. Buy Direct is one-click checkout inside the app, using saved payment details and addresses, starting from the For You feed. The brand stays the seller of record. Shopping Assistant is a chat on product pages that answers questions from information the merchant supplies. Agentic Leads puts an AI "lead agent" in direct messages and on brands' own forms, where it qualifies potential customers using brand-approved information. All three are tests open to eligible advertisers, with no markets, dates or prices published. TikTok also made its tool for letting AI agents set up and run ad campaigns available inside Claude, Perplexity, Replit, Snowflake and others. It said the number of advertisers using that tool had grown by more than 200% since launch, without saying from what.

Why it matters. Last week's evidence showed AI changing which brands people buy, while people still check reviews and creators before paying. TikTok already has the creators, the attention and the payment details. If agentic shopping grows fastest where those three already sit together, the winners may be feeds, not neutral assistants.

Why it might be noise. These are tests, not launches. A 200% rise means little without the starting number, and there's no data on sales. TikTok also carries real regulatory risk.

What it means for brands. A creator's video is becoming two things at once: persuasion for a person, and evidence a machine reads on the way to checkout. Which claims, demonstrations and reviews does each AI shopping tool actually use in your category?

Beyond advertising. Any platform that already holds people's attention and payment details can put an agent in between.

3. Gen Z likes brands but doesn't stick with them

What happened. On 7 October, the purchase-data company Attain and the agency group dentsu published a study combining a year of observed purchases (September 2025 to August 2026) with what young shoppers say. In the purchase data, Gen Z spends about 25% less a year than the average US shopper, but spreads it across 6% more merchants. In what they say, Gen Z shoppers are 25% more likely to value brand names over price, but 18% less likely to say they usually buy from the same brands.

Why it matters. A brand can keep its meaning while losing the repeat purchase. Winning becomes getting back onto the shortlist every time, not moving someone down a funnel once.

Why it might be noise. It's one company's panel, and its size isn't given. Having less money and trying more things may simply be what being young looks like. And the loyalty finding is what people say, not what they were seen to do; only the merchant figure comes from observed purchases.

What it means for brands. Track how often you get back onto the shortlist, not just loyalty. Ask whether being useful, or being backed by creators, brings people back more than how much they like you.

Beyond advertising. Anything that relies on habit, such as subscriptions, media or banking, may see the same pattern.

4. Making games is becoming something anyone does

What happened. On 7 October, Google Labs opened Playground, an experimental browser tool that turns typed descriptions into playable games, to adults in the US. The game-engine maker Unity announced Unity Spark, a browser game-maker that will plug into Playground for more ambitious projects; it's still in testing. The next day, Roblox reported early results from Build, its phone tool for making games from prompts, tested in New Zealand. More than 100,000 players have used it and about 9,000 games have been published. Of the people who made a game, 71% had never used Roblox's professional tools.

Why it matters. Photography and video went from specialist work to everyday expression. Games may be next, and small playable worlds could become something people send each other, like memes or short videos.

Why it might be noise. These are counts of games made, not games played or returned to. Generated games may be shallow and throwaway. Unity Spark hasn't launched. And more games may make the good ones harder to find.

What it means for brands. A playable idea could be briefed and built in an afternoon. The rules on safety, brand suitability and whose characters and ideas a prompted game can use don't exist yet.

Beyond advertising. Training, education and simulation could all use quick, cheap playable prototypes.

5. Laboratories are becoming something software can call

What happened. On 8 October, a White House fact sheet said the National Science Foundation (NSF) and the Department of Energy will invest over $100 million in "SI-enabled" scientific instruments and autonomous laboratories, where SI means super intelligence. It builds on a programme NSF announced in July: $380 million over four years for 20 teams building a network of programmable cloud laboratories, plus up to $20 million from the Astera Institute. The labs must be usable remotely and run experiments that users program themselves, through open, standard interfaces.

Why it matters. Parts of the physical world are becoming something software can call. Smaller companies, and eventually agents, may run experiments without owning a lab. The advantage may move from owning equipment to designing good experiments and owning the data.

Why it might be noise. Pricing, speed, reliability, access rules and who owns the data are all unproven, and government programmes move slowly.

What to watch. Who gets access first, at what price, and who owns the results. This goes on our watchlist, not our study list.

Agent identity, explained

A new employee gets a login, a job description and a manager before they touch anything. Agents now need the same:

Three moves get you most of the way

1. Its own identity. A separate account, key or connection for each agent or job. Never a person's own login.
2. Deny by default. Start with no access. Add one permission at a time, for a stated job. Write down what it must never do.
3. An action ledger. For every action: when, what, which permission allowed it, what it read, what it sent, what it cost, and who decided it should happen.

The test is simple: could someone who wasn't there rebuild one piece of the agent's work from the ledger alone? We tried it on our own production line. The honest answer was "partly": our log shows what happened and which key allowed it, but not who decided, and several tools share one set of keys.

The assumption we're challenging

"The best near-term opportunity with agents is building a better agent."

The case that it's breaking: this week's news wasn't about smarter agents. Google, Microsoft and Apollo GraphQL all shipped ways to name, contain and audit them. TikTok's tests are about where an agent sits (in the feed, next to checkout), not how clever it is. If the models keep improving and become interchangeable, the scarce parts are identity, permissions, evidence, cost and the way work is organised around agents.

The case that it survives: agents still fail at plenty of real work, and a clearly better agent can still win a market outright. Controls around an agent that can't do the job are just paperwork.

Where we've landed, for now: building agents is getting easier; trusting them isn't. The bigger opportunity, for companies and for careers, sits in what lets many agents do real work safely: who they are, what they may do, what they did and what it cost. We'll test this by watching where money and hiring go: agent-building tools, or agent identity, audit and cost.

What we're doing as a result of this week

• Making agent identity, permissions, audit and cost our next hands-on module. It's this week's lesson, and we've already run the first test on ourselves.
• Adding Gen Z's "likes brands, doesn't stick with them" as a new consumer signal, at medium priority until a second, independent study backs it up.
• Adding prompt-to-game as a signal to test, not study. We'll make one small game and report back.
• Adding programmable laboratories to our watchlist.
• Treating TikTok's tests as an upgrade to AI shopping, not a separate topic.
• Starting to test two new ideas:
• Over the next two years, what holds agents back from real work will more often be authority and accountability (who they are, what they may do, proof of what they did, and what it cost) than what the models can do.
• Agentic shopping will grow fastest inside platforms where discovery, creator trust and payment already sit together, not mainly in neutral AI assistants.
• Running this week's experiment: the ledger test.

Predictions based on the news

• By September 2027, Google, Roblox or Unity reports that at least 1 million games have been made or published with its AI game-making tools.
• By September 2027, TikTok publicly reports a sales figure (orders, sales value or share of sales) for purchases made through its in-app AI shopping assistant or one-click checkout.

Our four earlier predictions haven't moved. One near miss: TikTok's lead agent qualifies customers for advertisers, but nothing says advertisers pay by the agent's results, so it doesn't yet count for our prediction about ads priced on what an agent does. We check all six every quarter.

Learn next: running agents as named workers

Last week's module was about running agents: permissions, logs, memory, cost and sign-off. This week goes one level deeper, into identity:

1. Its own identity: every agent or job gets its own account, key or connection.
2. Deny by default: start from nothing and add only what the job needs.
3. An action ledger: record every action, the permission behind it, and who decided.
4. Cost attribution: every action's cost lands on the agent's own line, so you can weigh it against what it saves.
5. The rebuild test: check that someone else could rebuild the agent's work from the ledger alone.

The full learning module, with what we know, what we suspect and a step-by-step experiment, is at the end of this episode.

Try it this week: pick one AI tool that acts for you. Find out whether it has its own identity or borrows yours. Keep a simple ledger of what it does for a few days, then try to rebuild one thing it made from the ledger alone.

Questions to sit with

1. If an agent joined your team tomorrow under its own name, what would you want to see in its record before you trusted its work?
2. If your customers like you but don't come back by default, what brings them back: usefulness, creators or price?
3. If anyone can make a game in an afternoon, what would you make, and whose rules would it have to follow?

The illustrated guide

In Its Own Name

Before It's Obvious · Learn Guide · Episode 03 · Week of 10 October 2026

Agents get names of their own: what this week's five signals mean, how to run an agent as a named worker, and one experiment to try.

The big picture

Last week, the machinery for running agents arrived. This week:

• agents started getting their own names, at work, on computers and inside company systems;
• TikTok began testing shopping, checkout and sales agents inside the feed;
• young shoppers turned out to like brands without sticking with them;
• making games and running lab experiments became things you can describe rather than build.

The question is shifting from what may an agent do? to who did it, who gets the credit, and who pays?

Signal 1: Agents are getting their own names

On 7 and 8 October, three companies did the same thing at three layers:

• Google: a Gemini agent that can join a team with its own work account and email. Its edits show up under its own name. (Private preview.)
• Microsoft: containers that limit what an agent can reach, now generally available. On Windows 11 they can run an agent under its own account.
• Apollo GraphQL: agents get their own controlled pass to company systems, and every request is logged. Intuit is piloting it.

Why it matters: you can't limit, log or cost an agent you can't tell apart from a person.

Why it might be noise: previews, relabelling, and Microsoft's identity pieces are only "coming soon".

Signal 2: TikTok is building shopping into the feed

Announced 5 October, all in testing with eligible advertisers:

• Buy Direct: one-click checkout inside the app.
• Shopping Assistant: a chat on product pages, answering from the merchant's information.
• Agentic Leads: an AI agent that qualifies potential customers in messages and forms.

TikTok's tool for letting AI agents run ad campaigns now also works inside Claude, Perplexity and others.

Why it matters: creators, attention and payment already sit together in the feed. Agentic shopping may grow fastest there.

Why it might be noise: tests, not launches, and no sales data.

Signal 3: Gen Z likes brands but doesn't stick with them

From a study by Attain and dentsu (7 October):

• Gen Z spends about 25% less a year than the average US shopper, but across 6% more merchants.
• Gen Z shoppers are 25% more likely to value brand names over price…
• …but 18% less likely to say they usually buy from the same brands.

Why it matters: a brand can keep its meaning and still lose the repeat purchase. You have to win your place on the shortlist again each time.

Why it might be noise: one company's data, and the loyalty finding is what people say, not what they did.

Signal 4: Making games is becoming something anyone does

• Google Labs Playground (7 October): type a description, get a playable game. Open to adults in the US.
• Unity Spark: a browser game-maker that will plug into Playground. Still in testing.
• Roblox Build, tested in New Zealand: 100,000+ players, about 9,000 games published. 71% of the people who made one had never used Roblox's professional tools.

Why it matters: photography and video became everyday expression. Games may be next.

Why it might be noise: games made isn't games played.

Signal 5: Laboratories are becoming something software can call

• White House (8 October): NSF and the Department of Energy will invest over $100 million in "SI-enabled" instruments and autonomous labs.
• It builds on NSF's July programme: $380 million for 20 teams building programmable cloud labs, plus up to $20 million from the Astera Institute.
• The labs must be usable remotely and run experiments that users program themselves.

Why it matters: smaller companies, and eventually agents, may run experiments without owning a lab.

What we're doing: adding it to our watchlist, not our study list.

Agent identity, explained

A new employee gets a login, a job description and a manager before they touch anything. Agents now need the same:

• Own login: its own identity, not a person's borrowed one.
• Job description: a list of what it may do, starting from nothing.
• Name on its work: on every edit, message and action.
• Its own budget line: costs that add up to the agent.
• A manager: a named person who decided each action could happen.
• A record: a ledger good enough to rebuild its work.

The ledger test

Three moves get you most of the way

1. Its own identity. A separate account, key or connection for each agent or job.
2. Deny by default. Start with no access. Add one permission at a time.
3. An action ledger. When, what, which permission, what it read, what it sent, what it cost, and who decided.

The test: could someone who wasn't there rebuild the agent's work from the ledger alone?

We tried it on ourselves: "partly". Our log shows what happened, but not who decided, and several tools share one set of keys.

The assumption to challenge

"The best near-term opportunity with agents is building a better agent."

Against it: this week's news was about naming, containing and auditing agents, not making them smarter.

For it: agents still fail at real work, and a clearly better agent can still win.

Where we've landed, for now: building agents is getting easier; trusting them isn't. The bigger opportunity is what lets many agents work safely:

• who they are;
• what they may do;
• what they did, and what it cost.

This week's experiment

The ledger test. About 45 minutes, spread over a week.

1. Pick one AI tool or agent that acts for you.
2. Check: does it have its own identity, or borrow yours?
3. Write its permission list from nothing, plus one thing it must never do.
4. Keep a simple ledger for a few days.
5. Try to rebuild one thing it made from the ledger alone. Note what was missing.

Predictions based on the news

We'll check these every quarter

• By September 2027: Google, Roblox or Unity reports at least 1 million games made or published with its AI game-making tools.
• By September 2027: TikTok publicly reports a sales figure for purchases through its in-app AI shopping assistant or one-click checkout.

Questions for the week

1. If an agent joined your team tomorrow under its own name, what would you want to see in its record before you trusted its work?
2. If your customers like you but don't come back by default, what brings them back: usefulness, creators or price?
3. If anyone can make a game in an afternoon, what would you make?

Learn next: running agents as named workers, covering identity, permissions, the ledger and cost. The full learning module is below this guide.

This week’s learning module

Agent Identity: Names, Permissions and the Action Ledger

Learning module for Episode 03 (In Its Own Name), prompted by the follow-up to the "agent control plane" signal. Started 2026-10-10. The next hands-on part of the agent operations track, not a new track.

Core idea

Last week's module asked what an agent may do. This one asks who it is when it does it. An agent that borrows a person's login can't be told apart from that person, can't lose its access without the person losing theirs, and can't be costed. Big platforms are now giving agents their own identities, so the skill is learning to run agents as named workers: their own identity, access that starts at nothing, and a ledger good enough to rebuild their work.

Old: the agent logs in as you, and everything it does looks like you did it.

New: the agent has its own name→it starts with no access→each permission is granted for a job→every action is recorded under its name→its costs add up to its own line→a person can rebuild and explain any piece of its work.

What we know (fact)

• Google, 8 October 2026: introduced the Gemini agent (in private preview). Set up as a team "coworker agent", it gets its own Workspace account, email address and directory entry. Its edits appear under its own name in a document's version history, and its actions are recorded as the agent's, not a person's. Google also described a verified identity with least-privilege permissions, a sandbox, and one gateway that applies company-wide policy to every agent.
• Microsoft, 7 October 2026: made Microsoft Execution Containers generally available. They use policy to limit which files, network addresses and resources an agent can reach. On Windows 11, a session container runs an agent under its own Windows account, separate from the user's desktop. Telling agent activity apart from user activity in Microsoft's identity tools, and managing local agents centrally, are announced as "coming soon".
• Apollo GraphQL, 7 October 2026: launched GraphOS Agent Services in public preview. Agents get brokered credentials, so they "never hold upstream credentials"; access is controlled down to individual data fields; every request is logged for audit. Intuit is piloting it.

What we infer (inference)

• The same pattern appeared in a workplace suite, an operating system and the layer where companies' systems talk to each other, in the same week, from companies that weren't coordinating. That suggests a shared problem, not a marketing theme.
• Giving an agent its own identity is what makes the rest possible: you can't limit, log or cost something you can't tell apart from a person.
• The hard part is moving from "an agent did this" to "this agent, acting for this person, under this permission, did this, and it cost this much". Most of what shipped this week covers the first half. The attribution to a person and a budget is still mostly "coming soon".

The three parts of the skill

1. Its own identity. A separate account, key or connection for each agent or job. Never a person's personal login.
2. Deny by default. Start from no access. Grant one permission at a time for a stated job. Write down what it must never do, and enforce that outside the agent.
3. An action ledger. For each action that leaves the system: when, what, which permission allowed it, what it read, what it wrote or sent, what it cost, and who decided it should happen.

The test: could someone who wasn't there rebuild one piece of the agent's work from the ledger alone?

Worked example: can we rebuild last week's episode from our own ledger?

Our production line has logged every outside action since 4 October. We tried rebuilding Episode 02 from that log alone.

A further gap turned up while making this episode: when we ran production from a different folder, the automatic record of the assistant's own actions didn't switch on, and we had to add those entries by hand. A ledger that depends on being started in the right place isn't a ledger you can rely on.

What we'll change: a separate key for each paid service used by the show, a ledger entry for each approval as well as each action, and prices for every unit.

What we suspect (hypothesis)

• For the next two years, what stops agents doing real work will be authority and accountability (identity, permissions, audit and cost attribution) more often than what the models can do.
• The agent's own identity will become the unit companies budget and audit by, the way a cloud account is today.

What we expect (prediction)

• Nothing new this week. Our existing prediction stands: by September 2027, a company focused mainly on securing or controlling AI agents is bought for $1 billion or more, or reports more than $100 million in annual recurring revenue. Nothing qualified this week.

Practical experiment

The ledger test (about 45 minutes, spread over a week).

1. Pick one AI tool or agent that acts for you.
2. Check whether it has its own identity or borrows yours. Give it its own where the tool allows.
3. Write its permission list from nothing upwards, plus one thing it must never do.
4. Keep a ledger for a week: date, action, permission, read, wrote or sent, cost, and who decided.
5. Rebuild one thing it produced from the ledger alone. Note each gap.

What to record: whether the agent had its own identity, what you couldn't rebuild, and the one change that would close the biggest gap.

Work-data boundary: if you run this at work, keep the ledger in your employer's systems and follow their rules. Don't copy confidential content into a personal tool; a link, a file name or a count is enough.

Status: Revisit after a week of the ledger test.

Sources

• Google Cloud: Welcome to Gemini at Work 2026, introducing the Gemini agent
• 9to5Google: Google's Gemini agent
• Windows Developer Blog: Microsoft Execution Containers
• Apollo GraphQL: introducing GraphOS Agent Services
• Apollo GraphQL press release (Yahoo Finance)
• TikTok newsroom: AI-powered updates for advertisers
• TikTok for Business: agentic solutions
• Attain: Gen Z spends 25% less, shops more widely and has lower brand loyalty
• Google: Playground, an experimental gaming platform
• Unity: Google and Unity partner on a new AI gaming platform
• Unity: why we built Unity Spark
• 9to5Google: Google Labs Playground
• Roblox: how Roblox evaluates Build
• White House: science initiatives fact sheet
• NSF: $400M investment in a national network of programmable cloud labs
• NSF: Programmable Cloud Laboratories Test Bed solicitation