Salesforce has expanded Agentforce Coworker with reusable skills, conversation history and connections to Microsoft 365 and Google Workspace. It also plans broader access through Microsoft Teams, mobile and desktop applications, positioning the product as a single interface that can coordinate specialised agents and workflows around business tasks.

The company says more than 185,000 users are using Coworker and that usage increased 21-fold in three months. Those figures are Salesforce’s own measurements and have not been independently audited. Salesforce also disclosed a new price of US$50 per user per month, while noting that availability varies and some capabilities, including scheduled tasks and a daily digest, are expected in December rather than available now.

The expansion illustrates a shift from isolated chat interfaces towards agents embedded in the places where employees already work. That can reduce friction, but it also widens the governance surface. Context from email, calendars, files and customer records must remain subject to permissions, retention rules and review controls when the agent moves between systems.

For buyers, the useful evaluation is task-specific: which actions are supported today, what evidence is logged, where approval is required and whether productivity gains remain after licensing, integration and oversight costs.

Execution Level Governance- What audit-ready agent governance actually looks like
David Girvin, founder and CEO of Assury argues that model-in-the-loop review, AI governing AI, is fundamentally unreliable for regulated environments: even the best-performing models miss a meaningful share of violations, the reviewing model is typically provided by the same vendor being reviewed, and prompt injection or context poisoning can compromise both the acting agent and its supposed overseer simultaneously. He makes the case for deterministic, architecturally enforced controls instead, walking through Assury's approach of autonomy zones, session risk accumulation, and credential starvation, which lets a compromised agent be cut off from its tools instantly rather than relying on time-boxed access. The conversation touches on why David is sceptical of just-in-time credentialing as a solution for agent security more broadly, since agent sessions don't run on predictable human timescales, along with the current gap between how identity and security vendors are pitching agent protection and what he sees happening at the execution layer in practice. He also discusses the compliance and audit implications of probabilistic decision-making, arguing that regulated industries will increasingly need tamper-evident, hash-chained audit trails that can withstand scrutiny from auditors and regulators who are only beginning to understand agentic risk, and reflects on a named frontier lab's own published framework as an example of the gap between research and practitioner reality. Elsewhere, David reflects candidly on building a bootstrapped security company in an increasingly crowded market, why he turned down aggressive VC funding to stay in control of the product, and what a credible third-party assessment of his own gateway would need to look like given that Assury sits directly in the execution path for every customer's agents.
BrightTALK

Share this post
The link has been copied!