Technical context
The mechanism behind the headline
The business headline is that AI can begin work from real events. The engineering question is whether the trigger, identity, sources, tools, state, approval, evaluation, and recovery path are explicit and testable.
01 / Trigger and approval
An event can start the task, but it cannot grant authority
Cowork can start from a matching email or Teams message, including an @mention. The user describes the trigger and the work, then reviews the proposed automation.
Test false matches, duplicate delivery, rate limits, stale context, and replay behavior. Keep sends, posts, deletes, purchases, access changes, and external sharing behind approval until the workflow earns a wider boundary.
Source:Microsoft Learn - Cowork
02 / Retrieval authority
An authoritative label is a trust signal, not a content lifecycle
SharePoint authoritative sites can be prioritized in Copilot Search and labeled as organization content. The control still depends on content ownership, review dates, supersession, and removal of stale material.
03 / Inventory and ownership
The management plane has to admit the multi-vendor reality
Agent 365 registry sync can import agents from several platforms. Inventory is the first control, not the last. Lifecycle actions still depend on source-platform APIs, delegated roles, tenant relationships, licensing, and a named owner.
Source:Microsoft - Agent 365
04 / Orchestration and transport
The workflow is becoming reviewable infrastructure
Modern workflow systems can represent sequence, state, branching, handoffs, function and remote-tool calls, human approvals, checkpoints, and resume behavior in versioned source. The benefit is not novelty. It is a workflow that people can inspect, test, and recover.
Sources:Microsoft - Declarative workflowsModel Context Protocol - July 2026 specification
05 / Production operations
The product is the operating loop, not merely the model
Keep proposed changes, testing, approval, production behavior, and rollback as separate stages. A successful model response does not prove the surrounding system is safe.
Source:OpenAI - Presence
06 / Model fit and local compute
The best model is the one that completes the actual job
Own the task-level evaluation harness so the model remains replaceable. Cloud models, retained workstation models, phone runtimes, and specialist models serve different workloads. Treat them as options to test, not one category to standardize blindly.
Production gate
Eight questions before production
- Name the exact event that starts the work.
- Trace the user or agent identity and every token boundary.
- Name the authoritative source and its content owner.
- List every available tool and the policy that limits it.
- Define state, retries, duplicate handling, and expiration.
- Keep consequential actions behind visible approval.
- Evaluate the completed task, not only the model response.
- Prove audit evidence, rollback, and a safe manual path.