Persistent identity. Ephemeral computer.

The conceptual shift

The model is not the employee.

A chatbot waits and answers. A copilot assists a human. RPA follows a predefined flow using borrowed credentials. A digital worker owns bounded outcomes, preserves continuity and escalates exceptions.

The employee-shaped thing is not a model endpoint. It is the complete governed deployment:

Digital worker = model + harness + memory + World
               + computer + organisation identity
               + bounded authority + role + supervision + audit

The model supplies cognition. The harness supplies working method. Memory supplies experience. The computer supplies a desk and hands. Organisational identity supplies membership. Capabilities supply keys. Policy defines authority. Human takeover supplies managerial intervention.

The employee is not the computer. The employee borrows a computer when work arrives.

Stateful serverless workers

Asleep does not mean absent.

A worker can retain its identity, memory, inbox, files, pending work and schedule while consuming no CPU or RAM.

SLEEPING → event → WAKING → computer leased → WORKING → checkpoint → SLEEPING

Microsoft Graph notifications, Gmail push events, Teams mentions, SharePoint changes, calendar events, CRM webhooks and schedules wake the worker. The control plane receives events. An idle desktop does not need to poll Outlook all night.

Waiting for a person should also release compute

If an agent stages a £40,000 quotation and asks for approval, it should not hold a VM for six hours while a director is in a meeting. It checkpoints the World, releases the computer and wakes when Teams delivers the decision.

Action staged → World checkpointed → computer released
        ↓
Approval in Teams
        ↓ three hours later
Manager approves → worker wakes → work continues

Concurrency, not headcount

Ten thousand workers do not need ten thousand VMs.

The capacity question is not how many workers exist. It is how many are active at the same time.

average active = provisioned workers × active minutes/day ÷ 1,440

Dormant means zero CPU and RAM, not zero cost. Storage, queues, identities, subscriptions, audit and scheduling remain. API-only work can reach extreme density; full Chromium desktops are moderate; Windows Office and GPU workloads are lower.

Durable objects

Separate the worker from its body.

The worker feels persistent to the company, but models and computers remain replaceable.

Generic runtime pools serve browser, Office, engineering and media workloads. A task attaches one encrypted World overlay to one clean computer, grants short-lived capabilities, checkpoints the result and destroys or resets the runtime.

Concurrency is explicit. A worker processes its mailbox serially by default; parallel tasks receive independent copy-on-write branches rather than racing over one browser profile.

Provider neutrality

The computer should know almost nothing about Microsoft or Google.

Organisation-specific identity and application access belong in pluggable Organisation Packs and a capability broker outside the guest.

Expose common operations where the overlap is real—mail reading, drafting, file search and calendar work—while preserving native provider capabilities. Agnosticism should not erase what makes either ecosystem useful.

Agent computer → provider-neutral capability request
               → tenant broker → short-lived token
               → Microsoft Graph or Google Workspace

Human co-presence

Teams becomes the supervisor cockpit.

Takeover is not a remote-desktop gimmick. It is an explicit, exclusive and audited control lease.

1. The worker pauses and sends a private Adaptive Card: Watch, Take control, Deny or Stop.
2. The action opens a Teams personal tab or dialog.
3. Teams SSO identifies the tenant and operator.
4. The control plane validates the supervisor and issues a one-use viewer/control token.
5. An embedded WebRTC viewer displays the real computer.
6. Taking control stops agent input. The human resolves MFA, CAPTCHA or judgement-heavy work.
7. On release, the agent receives the resulting application state—never the password or secret input.

AGENT_CONTROL → HANDOFF_REQUESTED → HUMAN_CONTROL
              → HUMAN_RELEASED → AGENT_RESUME

View and control are separate permissions. Messages contain no bearer URLs or sensitive screenshots. Every pause, viewer connection, lease, release and resume enters the event history.

What exists today

The market has built the pieces separately.

Consumer agent computers, Microsoft Cloud PCs, hosted sandboxes, microVMs and orchestration projects each solve part of the system. None should be copied wholesale.

The opening

Composition is the product.

The underlying primitives are inspired by existing systems. The differentiation is the opinionated boundary around a provider-neutral SMB agent seat.

The moat is not creating VMs, streaming desktops, wrapping Graph, exposing MCP or snapshotting disks. It is cross-provider identity and access, persistent World semantics, human-agent supervision, governed external consequences and accumulated organisational memory.

Models provide intelligence. The agent seat turns intelligence into an accountable member of the organisation.

The best possible computer

Git for computers, not VNC with an API.

The ideal computer is a versioned, instrumented execution World that both agents and humans can inhabit.

• One coherent filesystem, process, browser and desktop state.
• API → shell/files → DOM/CDP → accessibility → pixels control hierarchy.
• Verified read-only base + role layer + tenant configuration + encrypted World overlay + task branch.
• Checkpoint, fork, diff and restore with explicit disk/live semantics.
• Low-latency watch, annotation, exclusive takeover and emergency stop.
• Default-deny egress, metadata/private-network blocks and bounded resources.
• Host-side credential and capability brokering.
• Append-only causal event history covering model-visible facts and external receipts.
• No model or harness dependency in the machine core.
• Truthful capability reporting with no silent degraded isolation.

The seat owns the durable World. Disposable Linux or Windows computers execute it. The same worker can change model, machine host or organisation provider without surrendering its continuity.

Build discipline

Non-negotiables.

1. No raw long-lived organisation credentials in guests.
2. No silent unconfined fallback.
3. No default metadata or private-network access.
4. No split local-file and remote-shell execution world.
5. No unbounded process, output, disk, time or connection growth.
6. No viewer without current machine and lease authorisation.
7. No model or harness dependency in the machine core.
8. CLI and SDK first; MCP optional.
9. No fleet control plane before one-host lifecycle, cleanup and recovery are reliable.
10. Every irreversible external effect must be policy-checked and receipted.

Commercial shape

Agent seat       identity, memory and governance
Computer usage   active execution
Storage          World and history
Premium runtime  Windows, GPU or high-memory work

The customer provisions a persistent governed seat and pays for execution actually used—not a continuously running VM per agent.

Primary references

Further reading.

• Grok Bot — computer and apps
• Grok Bot — approvals, security and privacy
• Windows 365 for Agents — computer and takeover surfaces
• Windows 365 for Agents — session lifecycle
• Microsoft Entra Agent ID — OBO flow
• DeepSeek Harness
• E2B, CubeSandbox, Microsandbox, BoxLite