Personal AI Agents Are Not Enterprise Agents: What Muse, Dots and Grok Bot Mean for Your Company Data

In the space of seven weeks, four personal AI agents arrived:

Grok Bot from xAI (11 August): always-on agents, each with its own cloud computer, that sign into your tools and complete multi-step work.
Instinct (26 August, invite only): an assistant you text or call, which books, cancels and fills in forms for you by operating a browser and a phone.
Meta Muse (announced 8 September): an agent that runs errands for you, from shopping and tickets to appointments and school forms.
OpenAI dots (29 September): persistent assistants inside ChatGPT, each with its own cloud computer, browser and memory, and access to more than 4,000 connected apps.

I've tried some of these, and they're impressive. For booking a dinner, sorting a personal calendar or chasing a refund, they save real time.

The question I keep getting from CIOs this month is a different one: "My staff are asking if they can use these at work. Should I let them?"

My answer is to keep personal agents personal. Not because the products are bad, but because of what they are designed to do.

A personal agent is designed to act as you

The whole point of a personal agent is that it does things on your behalf, as you. To book your flights, it needs your email. To move your meetings, it needs your calendar. To find that contract, it needs your drive. Grok Bot, for example, signs into your tools with your own credentials. That's the design, and for personal life it's the right one.

Now bring that design to work. When an employee connects a personal agent to their work account, the agent doesn't get access to one task. It gets access to everything that employee can reach.

Picture a sales manager who connects one to their work inbox to help with follow-ups. Within a day it has read customer pricing threads, a salary discussion with HR, and a board pack someone forwarded "for awareness". It may have summarised some of that into its memory, on the vendor's cloud. The sales manager didn't intend any of it. They wanted help with follow-ups.

This is the part that worries me most: you lose track of what has been passed to the agent. Nobody at the company can say what it read, what it stored, or what it sent. And when that employee resigns, the agent may still hold the access they granted it, until someone notices.

We wrote last month about employees pasting company data into chatbots. Personal agents are a bigger version of the same problem, because they don't wait to be given data. They go and get it.

Four questions every agent at work must answer

When we design an enterprise agent, there are four things we have to be able to answer before it touches a client's systems. They're the same four questions I'd ask about any agent an employee wants to bring to work.

Four questions every agent at work must answer. Authentication: who is acting? Authorisation: what can it touch? Logging: what did it do? Governance: who answers for it? For each, a personal agent's answer is compared with an AutoGo agent's answer.

1. Authentication: who is acting?
A personal agent acts as you. When it sends an email or opens a file, the system sees you. An enterprise agent has its own identity, a service account the IT team created for that one job. When it acts, the logs show the agent, not a person pretending to be one.

2. Authorisation: what can it touch?
A personal agent can reach whatever you can. An enterprise agent is given only the tools one business process needs. An invoice agent can read the vendor master and create a supplier invoice after approval. It can't open email, HR files or payroll, because those aren't on its list. If it tries, the request is refused and the task stops.

3. Logging: what did it do?
A personal agent keeps whatever its app keeps, on the vendor's side, in a format your auditors have never seen. An enterprise agent logs every action inside your own environment: what came in, what it read, what it proposed, who approved it.

4. Governance: who answers for it?
A personal agent has no owner in the organisation, no review date, and no off switch that IT controls. An enterprise agent has a named business owner, a person who approves its consequential actions, and can be switched off centrally in minutes.

If an agent can't answer all four clearly, it isn't ready for company data, however good the demo is.

What an enterprise agent looks like in practice

This is how we build AutoGo, and it's worth being concrete, because "enterprise-grade" gets used loosely.

Every AutoGo agent automates one business process, such as supplier invoice processing. It runs under its own service identity. It reaches company systems only through an AI API layer that checks who is calling, checks whether that call is allowed, logs it, and holds anything consequential for a person to approve. If a tool call is refused, the agent stops and escalates. It doesn't go looking for another way in, which was exactly the design gap in the OpenAI Medicare incident.

It runs inside the client's own Azure tenant, in a Malaysian or Singapore region, so the data and the logs stay where the client's PDPA and regulatory obligations expect them to be. And every agent has a named owner on the client side.

None of this makes an enterprise agent cleverer than a personal one. It makes it accountable. That's the difference that matters at work.

To be fair to the vendors, some are moving in this direction. OpenAI offers dots to enterprise customers as a beta that an administrator has to switch on, which is a sensible step. But the starting design of a personal agent is still an assistant that works as one person, across that person's apps. Enterprise agents start from the opposite end: one process, the minimum access, and a full record.

What I'd do this week if I were a CIO

You don't need a new AI strategy to deal with this. Four practical steps:

Say yes to personal agents for personal life. Banning them outright just pushes usage out of sight. Be clear that they're welcome for personal tasks, on personal accounts.
Stop work accounts being connected without approval. Microsoft Entra ID and Google Workspace both let administrators restrict which third-party apps users can grant access to their work accounts. If that isn't locked down yet, do it now.
Find out what's already connected. Both platforms show which apps already hold access to staff accounts. You may be surprised. Revoke anything that isn't sanctioned.
Offer a sanctioned path. Staff reach for personal agents because they want the work to be easier. Give them an approved way to automate their most repetitive process, with the four questions answered, and most of the pressure goes away.

The bottom line

Personal agents are a genuine step forward, and I expect most of us will use one in our personal lives within a year. But they're built to be you, with everything you can access. That's the right design for booking a holiday and the wrong one for handling customer contracts, salary data or financial records.

Keep personal agents personal. Bring enterprise agents to work: their own identity, only the access the process needs, every action logged, and a named person accountable.

If your staff are already asking to use personal agents at work, that's a useful signal: there's a process they want automated. We'd be glad to help you find it and automate it properly.