# Productivity and collaboration
What office tools must provide for agents: every agent gets its own identity with a named sponsor, a mailbox or meeting seat is a rare separate grant, and assistants roll out task by task.
Author: Murali Sid (https://linkedin.com/in/muralisid)
Source: https://www.agenticarchitectureskills.com/layers/r08-productivity-and-collaboration
Published: 2026-08-20
Updated: 2026-10-15
Licence: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/
Cite as: Murali Sid. Productivity and collaboration. Agentic Architecture Skills. https://www.agenticarchitectureskills.com/layers/r08-productivity-and-collaboration
---
The productivity and collaboration layer (R08) is the office suite: email, calendars, documents, chat and meetings. It is one of the [fourteen layers](/layers) you own. Today it holds Microsoft 365 or similar, spreadsheets that track exceptions, and the first assistant pilots. It is where most staff meet an agent first, and where the most company data passes through one. For agents, this layer must provide four things. Every agent gets its own agent identity with a named sponsor. A mailbox or meeting seat needs a separate agent user account, granted rarely. Shared files and chats are permissioned before an assistant can search them. Staff use of personal AI accounts is governed through identity, not by blocking. Rollout then follows the task, because the measured gains are in work people do alone.
## What sits in this layer today [#what-sits-in-this-layer-today]
Here is what a typical estate already runs in this layer. Vendors in brackets are examples, not a market claim.
| System category | Electricity distributor | Water utility | Hospital network | Generator, oil and gas, or miner |
| --------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | -------------------------------------------- | -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| Email and calendar (Microsoft 365 Outlook and Exchange) | Many handoffs run on email. They are invisible to the systems of record | Same | Exchange, beside fax servers that still receive referrals | Email carries the daily production report and most evidence requests |
| Chat and meetings (Microsoft Teams) | Teams carries many handoffs | Same | Teams or video for multidisciplinary meetings | Teams carries the morning meeting |
| Documents and intranet (SharePoint) | SharePoint sites and libraries | Same | SharePoint, the intranet and a policy library (PROMPT or SharePoint) | SharePoint. Shift handover logs |
| Spreadsheets as trackers (Excel) | Spreadsheets hold many exception trackers | Same | Not named in the research | Excel is the real integration tool in most plants (typical, unsourced) |
| Assistants in the suite (Microsoft 365 Copilot) | Copilot. SA Power Networks runs an internal "Ask AI" over manuals (September 2026) | Copilot, widely used in UK water (June 2026) | Copilot pilots | Copilot. Uniper builds agents in Copilot Studio \[vendor] |
| Field and shift communication | iPads in the field | Same | Secure clinical messaging apps | Two-way radio. Tablets for short interval control. Pre-start and toolbox talk material |
| Agent identity in the directory (Microsoft Entra Agent ID and others) | Not yet in place. An agent needs its own identity in each system it calls | Same | No Australian or NZ public health service found with an identity per agent | Not yet in place. An agent needs its own identity in IT and in the plant network's buffer zone |
Standards: none specific to the suite in utilities. Hospitals follow state records law and retention schedules. Energy and resources companies apply ISO 15489 for records. The full estates are on the [utilities](/use-cases/utilities), [healthcare](/use-cases/healthcare) and [energy](/use-cases/energy) pages.
## What agents add [#what-agents-add]
### Every agent gets its own identity [#every-agent-gets-its-own-identity]
In Microsoft's design, an agent identity is a service principal in the enterprise directory. A service principal is the directory's account type for software, not people. It carries a sponsor field: the person or group accountable for the agent. The sponsor is also the contact if a security incident happens. From July 2026, every new agent must have an agent identity, with no opt-out \[vendor]. Creating agent identities uses a permission that is granted automatically and cannot be revoked. It is capped at 250 agent identities per blueprint, the template an agent is built from \[vendor]. Agent identities are deleted when the agent is deleted, so orphan accounts do not pile up. An agent cannot exist without an identity, so the inventory is complete by design. On the [delegation chain](/architecture/delegation-chain), this is the agent's own identity (ID2).
### A mailbox or meeting seat is a separate grant [#a-mailbox-or-meeting-seat-is-a-separate-grant]
An agent user account is a different object. It is an optional user account tied one to one to the agent. It exists only where the agent needs to act as a user. It brings a mailbox, a calendar, a licence, a place in the HR system or a meeting-roster seat. Creating one needs a permission that an administrator grants and can revoke \[vendor]. No user account is created automatically. The agent's own identity plus an agent user account is ID3 on the delegation chain.
An agent can be named without a user account. Its display name shows in Teams, Outlook and admin screens. It can be @mentioned in Teams and Slack without one. A user account also does not buy accountability, because the sponsor field already carries it. Nor does it change how people work. One study compared an always-present agent with one called on demand (AIES 2026, 157 people). Trust did not shift much, and accountability stayed with the human expert. So grant an agent user account per need, rarely, with a recorded reason.
### Shared content is permissioned first [#shared-content-is-permissioned-first]
An assistant can surface any file its user can open. Field evaluations record assistants surfacing files users should never have seen. That is oversharing from the [data platform layer (R02)](/layers/r02-data-platform), showing up here first. So fix permissions on files, sites and chats before deployment, not after. Take a water utility's billing exceptions as an example. The trackers often live in Excel, email and Teams. An agent that reads them needs its own identity and the same access rules as a person.
### Personal AI accounts are governed through identity [#personal-ai-accounts-are-governed-through-identity]
Blocking moves usage rather than stopping it. About 90 percent of organisations block at least one generative AI app \[vendor]. Yet 47 percent of users reach AI tools through personal, unmanaged accounts \[vendor]. An average organisation records 223 incidents a month of sensitive data sent to AI apps \[vendor]. Connector permissions appear as API permissions that conditional access can target. Conditional access is the directory's set of rules on who may reach what, and from where. So the policy engine that governs staff sign-ins also governs what an agent can reach. Make the approved path easier than the personal account.
### Roll out by task [#roll-out-by-task]
Measured gains so far come from work people do alone, such as email. Meetings and shared documents change only when the team agrees new ways of working. So route solitary, single-author work to the assistant by default. Route shared work there only with a decision to change the team's norms. Drafting and summarising gain time. Data analysis and scheduling lost time in one government evaluation. Measure each task's outcome and keep what improves it.
### Meetings need consent [#meetings-need-consent]
Notetaking is the most common use of agents in collaboration tools. Capture consent and disclose recording by default. Keep meeting records with their consent records. Align retention with recording law in each place. Two US class actions over meeting recording are active, one filed in July 2026.
### The assistant's mode is a setting [#the-assistants-mode-is-a-setting]
An assistant can rewrite people's ideas, or draw them out with questions. Rewriting improved quality but cut the variety of ideas and people's sense of ownership. Asking questions improved quality and kept both (486 participants, checked again with 640). So set the mode per surface and record it as configuration that can be reviewed. Use questions wherever a variety of contributions matters.
### Review is shallow, so controls must not rely on it [#review-is-shallow-so-controls-must-not-rely-on-it]
In five-hour coding tasks, 94 percent of developers missed deliberate sabotage inserted by an agent. When a safety monitor flagged it, 56 percent still accepted the malicious code. So assume review effort is low when sizing controls. Judge oversight on how many errors people catch, not on their confidence or speed. Treat any control that raises confidence without raising accuracy as a step backwards.
| Part | What it does | Where it runs |
| --------------------------- | ----------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
| Agent identity | One service principal per agent, with the sponsor recorded. Deleted with the agent | The enterprise directory (Microsoft Entra Agent ID and similar) |
| Agent user account | An optional user account where an agent must act as a user. Granted by an administrator and revocable | The directory and the collaboration suite |
| Suite assistant | Help with solitary tasks: email, summaries, drafts | Licensed seats across the tenant |
| Agent builder | Narrow agents built by staff, each with an automatic identity and scoped connectors | Low-code builders inside the suite |
| Meeting capture | Notes and transcripts, with consent captured and recording disclosed | Meeting platforms and specialist notetakers |
| Personal-account monitoring | Detects personal AI accounts and sensitive data leaving the organisation | The existing security service edge and data loss prevention tools |
## What must be true before an agent touches it [#what-must-be-true-before-an-agent-touches-it]
Before an agent reads a mailbox, a file or a meeting, these must hold.
* **It has its own identity and a sponsor.** The agent's own identity (ID2) is the minimum. No agent uses a colleague's account.
* **Its connectors are scoped.** Conditional access targets its connector permissions.
* **Any user account has a recorded reason.** An administrator grants it per need and can revoke it.
* **Content permissions are fixed first.** Files, sites and chats are permissioned before the assistant can search them.
* **Meeting consent is captured.** Recording is disclosed, and retention follows recording law in each place.
* **Its output is labelled.** No agent presents as a colleague without saying it is an agent.
* **It is on the lifecycle.** It has a registry record, a sponsor and a periodic review, as the [agent lifecycle](/architecture/agent-lifecycle) sets out. The [governance, risk and sovereignty layer (R11)](/layers/r11-governance-risk-sovereignty) keeps the registry.
* **A new grant is scored again.** A new tool grant changes its permissions, so its [risk profile](/architecture/risk-profile) is scored again.
The enforcement point is the directory and its conditional-access rules, not a proxy blocklist. The [security and identity layer (R10)](/layers/r10-security-and-identity) runs that policy engine. Policy sits outside the model, as [enforcement outside the model](/architecture/enforcement) describes.
## Choices and their verdicts [#choices-and-their-verdicts]
Each choice is the common choice, tested against the simplest credible alternative. The full records are in the [decision catalog](/decisions).
* **[One assistant or many specialised agents](/decisions#cd-23) (CD-23):** the wrong question. Ask whether the work is solitary or shared, and whether the team will change how it works.
* **[One agent or many](/decisions#cd-21) (CD-21):** a separate design choice. Several agents pay off only for wide, independent work.
* **[Agents as workforce or as tools](/decisions#cd-22) (CD-22):** keep the accountability and drop the personnel metaphor. The sponsor sits on the identity, and agents need no employee records.
## Concerns this layer must honour [#concerns-this-layer-must-honour]
The ten cross-cutting concerns are set out in the [concern matrix](/architecture/concern-matrix). This layer carries a specific duty for seven of them.
* **Identity and access:** agent identity is mandatory and automatic. User accounts are granted per need, with a reason.
* **Observability:** actions per active user per day, outcomes by task type, and signs of personal-account use.
* **Traceability and audit:** meeting records are kept with their consent records.
* **Grounding:** permissions on files, sites and chats are fixed before deployment.
* **Impersonation:** agent output is labelled in shared spaces.
* **Privacy:** notetaker consent, limits on monitoring workers, and leakage through personal accounts.
* **Cost:** usage is measured against licence spend, and tasks that lose time are stopped.
## Evidence and limits [#evidence-and-limits]
The pay-off evidence is consistent: the more rigorous the method, the smaller the effect. The largest field experiment covered 66 firms and 7,137 workers for six months. Users spent two fewer hours a week on email. No other change in the amount or mix of work was detected. Meetings and document counts showed no measurable effect.
UK government evaluations show the same pattern. Self-reported savings came to 26 minutes a day. A comparison study at the Department for Work and Pensions found 19, and a randomised one at HMRC about 12. Danish data showed no effect on earnings or hours. A Department for Business and Trade evaluation observed tasks with six people per group. Summarising got much faster, while Excel analysis got slower and less accurate.
Reviewers miss most deliberate errors, but the sabotage study is a preprint. A pooled analysis of 106 studies found people and AI together did worse than the better of the two. The losses were largest in decision tasks, and review is a decision task.
The identity mechanics and the July 2026 mandate come from Microsoft's documents \[vendor]. Check them against your own tenant. Personal-account figures are security-vendor telemetry \[vendor]. No study compares agents with user accounts against agents called on demand at organisational scale. No rigorous study shows how notetakers change what people say.
## Next step [#next-step]
See this layer at work in the proposed [compliance evidence](/use-cases/compliance-evidence) example. Then read the next layer, the [experience and channels layer (R09)](/layers/r09-experience-and-channels).
Explore this topic
* [Productivity and collaboration findings](/library/layers/r08-productivity-and-collaboration/findings) and [sources](/library/layers/r08-productivity-and-collaboration/sources).
* [Products named for orientation](/architecture), on the one-page wall chart.
* Estate table: industry research for utilities, healthcare and energy, 15 October 2026. Rows are industry knowledge unless a source is named.
* Table sources: SA Power Networks "Ask AI" (iTnews, 8 September 2026). Ofwat plan on Copilot use (June 2026). Uniper on Copilot Studio (Celonis case study, undated) \[vendor].
* Identity mechanics: Microsoft Entra agent identity documentation, 2025 to 2026 \[vendor]. The sponsor is "the human user or group that's accountable for an agent".
* Personal-account telemetry: security vendor, January 2026 \[vendor]. 18,000 prompts a month per organisation. 223 sensitive-data incidents a month, 2,100 in the top quartile. 54 percent of violations involve regulated data.
* The same telemetry shows AI users up 200 percent and prompt volume up 500 percent in a year \[vendor].
* Field experiment: Dillon, Jaffe, Immorlica and Stanton, NBER working paper 33795, revised November 2025. Meeting bounds rule out effects outside -0.01 to +0.21 hours against a 5.22-hour weekly mean.
* Danish data: NBER working paper 33777. Bounds rule out effects above 1 percent, beside 3 percent average time savings.
* UK evaluations: 26 minutes a day self-reported. 19 minutes at DWP, quasi-experimental. About 12 minutes at HMRC, randomised.
* DBT evaluation, August 2025, six people per group. Summarising a report took 12:37 with the assistant against 41:34 without, with accuracy 4.0 against 2.5.
* DBT task results: email writing about equal in time with better quality. Presentations faster, but accuracy 1.5 against 5.0. Excel analysis 25:01 against 20:33, with accuracy 1.5 against 2.7.
* DBT adjusted hours saved per task: drafting 1.3, summarising 0.8, presentations 0.0, image generation -0.5, scheduling -0.6.
* DBT quality checks: none at all in 15 percent of data-analysis uses and 36 percent of scheduling uses.
* Spend: one market survey, December 2025. Copilots take 86 percent of horizontal application spend, against 10 percent for agents.
* The same survey: 64 percent weekly active users, but only 1.14 actions per user per day. Coding is the one department to break out, at $4.2 billion of $7.3 billion.
* One firm generated about 15,000 narrow agents built by staff after a company-wide rollout. Only 16 percent of enterprise deployments qualify as true agents.
* Always-present versus called on demand: AIES 2026, 157 participants. The change "did not substantially redistribute trust".
* AI teammate trial: 16 AI teams against 17 all-human teams, July 2026 preprint, student sample. The AI was the most talkative and least informative member. Responsiveness, belonging and status were lower.
* Sabotage study: Ye and colleagues, arXiv 2606.05647, June 2026, preprint, 100+ participants.
* Trace-reading interface: three vendor research studies, February 2026 \[vendor]. It cut time to find errors and raised confidence without meaningfully improving accuracy.
* Meta-analysis: 106 studies, 370 effect sizes, registered in advance. Effect size (Hedges g) -0.23.
* Interaction mode: 486 participants, validation study of 640. LLM rewriting also shifted the political values in people's comments (CHI 2026, 465 participants).
* Meeting recording: the consolidated Otter.AI action in the Northern District of California. The Granola action, filed 30 July 2026 under the California Invasion of Privacy Act, with $5,000 statutory damages per violation.
* Notetaker survey, July 2026, 500 US workers: 33.4 percent had met an AI notetaker. Of those, 34.7 percent were always asked permission and 25.1 percent never were.
* 18.8 percent of all workers had found a meeting recorded without their knowledge.
* Notetaking is 16.43 percent of all reported collaboration-agent uses. 110 million Meet attendees used automatic notes in a month, 8.5 times the year before \[vendor].
* No independent field study publishes production accuracy for meeting summaries. No vulnerability records attach to this layer in the research window.
* Excluded: a widely shared share of companies said to have delayed copilot rollouts. It traces to a vendor security survey about data-protection risk, not worker consultation.
* Re-verify quarterly: the identity mandate's scope and caps, conditional-access coverage of connector permissions, and the personal-account telemetry baseline.