Free Agentic AI Security Workshop Map your footprint, identify your highest-risk gaps, and leave with a customized security summary. Book a Workshop→
Start assessment

Proactive AI Agents & Zero Trust: Who Sets the Policy?

November 12, 2026 · Jason Garbis

Proactive Agents: A Zero Trust Perspective

Dots, Muse, Duet, and Autopilot: Who Sets the Policy?

Something small but remarkable occurred this autumn: One of OpenAI’s early testers had forgotten to invoice a publication. The proactive agent (the “Dot”) noticed this, prepared the invoice, obtained his approval, and sent it. Nobody asked it to go looking. This is the essence of our new set of proactive agents, and from a security perspective, we need to get ready.

In the past six weeks, four vendors shipped proactive agents that start work on their own. Meta launched Muse on September 8. Microsoft announced Copilot Autopilot (the renamed and expanded Scout) on September 25. Meta announced its Enterprise Platform on September 28, which we covered in our MEP post, and extended Muse to small businesses the next day. OpenAI introduced Dots that same day. Anthropic opened a research preview of Claude Duet on October 21.

Proactivity changes who starts the work. For security teams, that moves the question from “what can this agent do?” to “who decided it should?” In this post we look at how each vendor answers that, using Zero Trust as the lens, and why for most of these products the answer is someone other than the enterprise.

What makes an agent proactive

Strip away the branding, and these products share a surprisingly common architecture. Each agent gets its own computer in the vendor’s cloud, with its own browser, so it keeps working after you close your laptop. It inherits the connectors you’ve already granted the parent assistant: mail, calendar, Slack, CRM, accounting, etc. It runs a background loop that reads those sources looking for something to do, and typically stops at an approval gate before anything consequential, like sending a message, paying, or deleting. And all of them keep credentials away from the model, so the agent proposes actions while something it can’t touch holds the secrets and decides whether the action goes through.

These new agents have two new properties: Agent initiative, and persistence. Simple chat assistants wait for a prompt and work within a session, and coding agents work on a given task and then stop. A proactive agent decides what deserves your attention and keeps context for weeks.

In our agentic AI security taxonomy, those are new values on two of the six analytical attributes: Autonomy (who initiates the work) and Lifecycle (how long the agent lives). We’ll come back to why that matters when we place these products in the taxonomy.

Three personal agents

The three personal agents share patterns, so rather than walk through features, we’ll pick out what each one does differently.

Dots (OpenAI)

OpenAI’s most interesting design choice is separating finding work from doing it. When you aren’t working with your dot, its background research runs with read-only tools: it can’t send messages, change content in connected apps, or drive a browser, and OpenAI says it enforces those limits in code. Anything the dot wants to do afterward passes through Auto-review, a separate system that checks the planned step against your instructions, your Custom Rules, and OpenAI’s safety requirements. Auto-review’s controls sit outside the environment the dot can change. Dots also show up where work already happens: you can message yours in ChatGPT, Slack, or Teams, and it carries context across all of them. Dots are rolling out on ChatGPT Pro and Business Premium, with an Enterprise beta that a workspace admin has to switch on.

Muse (Meta)

Meta published the most detailed architecture of the three. Each user’s Muse lives in a dedicated VM split into two security domains: a runtime cell where the agent works and handles untrusted data, and host-side services it can’t reach. One of those services, Sentinel, is the sole permission authority for connector actions and network egress. The agent only ever sees surrogate tokens, and Sentinel swaps in the real credential at the network boundary once a request is approved. Meta even tracks at the kernel level whether a process has read user data (it calls this tainted egress) and withdraws auto-approval when it has.

One other thing that sets Muse apart is reach. It’s free for most uses, and exceeded 10 million downloads in its first 40 days. Muse for Small Business is the same app with connectors added for Shopify, QuickBooks, Stripe, Slack, and others.

Claude Duet (Anthropic)

Duet’s most distinctive control watches what data leaves. A classifier that runs separately from the main model checks every outgoing message against two tiers. Credentials, full card and bank account numbers, and government ID numbers are never shared, even if you ask. Other private information, such as health or finances, goes out only with your consent. Credentials follow Anthropic’s Managed Agents design: a placeholder sits on the agent’s machine, and a proxy outside it inserts the real value as the request goes out. Duet’s browser also identifies itself, with a distinct User-Agent header and published IP addresses, so sites can tell it apart from you.

Duet is currently a research preview for US Pro, Max, and Ultra subscribers. There’s no enterprise plan yet, but we certainly expect one to arrive before long.

Proactive agents and Zero Trust

We’ll start with what the vendors got right, because there’s a lot of it. Much of Zero Trust architecture is oriented around two components: A policy decision point (PDP) decides whether a subject may take an action on a resource. A policy enforcement point (PEP) sits in the path and carries out that decision. All three vendors built a recognizable PDP and PEP around their agents. Meta’s Sentinel is both in one service. OpenAI’s Auto-review is a PEP backed by a policy engine the dot can’t modify. Duet’s credential proxy and approval check play the same role on the network path.

The premise behind each design is “assume breach”, applied to the agent itself. Meta says outright that it designed Muse on the assumption that the agent may be under attack. Each vendor expects the model to be talked into a bad action eventually by content it reads, so each puts enforcement somewhere the model can’t reach. Grants are scoped, too. Muse approvals are bound to a specific connector and use case and can be one-time, task-scoped, or time-bounded. OpenAI says an approval stays tied to the task and doesn’t expand when the dot picks the work up later or delegates it. That lines up well with the Zero Trust tenet that access is granted per session.

So far this reads like a Zero Trust success story. But…now we need to ask ourselves where the PDP gets its policy. For personal Dots, Muse, and Duet, it comes from the vendor’s built-in rules and the individual user’s settings. The enterprise isn’t a policy source anywhere in the loop. An employee who connects corporate Gmail, Slack, and Salesforce to a personal agent has set up a well-engineered Zero Trust architecture in which their employer sets none of the policy.

Three consequences follow from that.

1: Agent traffic looks like the user. The SaaS application sees the user’s OAuth grant and nothing more. Meta is explicit that when Muse browses, it shows up as your activity. Duet is a partial exception because its browser identifies itself, but its connector calls still use the user’s grant.

2: Access revocations are incomplete. Disconnecting an app stops new access, but OpenAI and Anthropic both say that what the agent already learned from it stays in its context until memory is reset. Revoking the grant doesn’t revoke the derived data, and only the user can reset it.

3: Untrusted content can arrive through the back door. Content an agent reads in the background can still shape a later action. For example, Dots’ read-only fence is a good control, but it limits what the research task can do, and the notes it writes flow back to the dot that acts. That leaves Auto-review as the control that has to catch it. This is where proactivity changes the threat model. An agent reading inbound mail that nobody asked it to read is consuming untrusted content all day.

The enterprise-governed alternative

Two products show what this looks like with the enterprise as the policy source. OpenAI previewed specialist dots, which an organization sets up with their own identity, credentials, IT-provisioned compute, and access to systems of record. Each one owns a defined workflow instead of assisting one employee. They start as enterprise pilots, and OpenAI is working with Microsoft to manage them through the governance and security controls in Agent 365.

Microsoft’s Autopilot (formerly Scout) starts from the enterprise side. It runs inside the customer’s Microsoft 365 tenant with its own Entra identity, memory, and email address. A developer builds an Autopilot blueprint from a Foundry-hosted agent, and it appears in the Agent 365 registry only after an administrator approves it. Employees can then hire instances of it in Teams. Agent 365 supplies the permissions, audit records, and admin controls around it.

That’s the right approach, though it raises questions of its own. When a long-running agent works for an employee whose role changes mid-task, how quickly does its scope follow, and who revokes it? Autopilot is in private preview, and Microsoft has saved more detail for Ignite (November 17 to 20), so treat the  specifics here as subject to change.

The table puts all five side by side. Note the consistency within the enforcement column, while the policy and control-plane columns differ considerably across rows.

Comparison table of AI agents showing policy ownership, enforcement location, agent identity, and enterprise control plane for Dots, Specialist dots, Muse, Duet, and Autopilot.

Where these fit in our taxonomy

Personal Dots, Muse, and Duet are Provider-hosted agents. The vendor runs them, and they reach into enterprise systems through the user’s grants. Autopilot is SaaS-embedded, an office-suite agent that lives inside the suite’s own identity and governance boundary. (Its blueprints are built from Foundry-hosted agents, which gives it a foot in Platform-built, but the tenant is where it runs and where it’s governed.)

A couple of aspects are worth noting. Dots can optionally connect to the user’s own computer, which reaches into Local-access territory. Specialist dots move the Identity and Management attributes toward enterprise control, which is the direction we’d like to see the whole Provider-hosted category go.

What to do today

None of this calls for a new security program, but does call for pointing the controls you already have at a new kind of grant.

  • Identity. Inventory the OAuth grants employees have made to OpenAI, Meta, and Anthropic through your IdP or SaaS security posture tooling, and look for the scopes a proactive agent uses: mail, calendar, chat, files, CRM. Decide whether user consent to third-party apps should be allowed at all for those scopes. For any agent that owns a workflow (rather than assisting one person), require a first-class agent identity, the model that specialist dots and Autopilot follow, and don’t let it borrow an employee’s.
  • Data. Treat agent memory as derived data that outlives the grant that produced it. Ask each vendor how memory is purged when an app is disconnected or an employee leaves, and whether an administrator can trigger that purge.
  • Visibility. Expect activity in your SaaS logs that you can’t attribute to a person or to an agent. Where a vendor helps, as Duet does with its User-Agent header and published IP addresses, build that into detection. Where a vendor doesn’t, ask it to.
  • Governance. Make an explicit decision per vendor: block, allow for a pilot group under a written policy, or allow with conditions. A personal agent connected to corporate systems is shadow IT that runs on a schedule, and the policy is easier to set before adoption than after it. If you’re on ChatGPT Enterprise, keep the Dots beta switched off until you’ve made that call.

Looking ahead

The next proactive agent will arrive with its own enforcement plane, and it will probably be a good one, as vendors have absorbed Zero Trust principles. What every one of them still has to answer is who sets the policy that the plane enforces. Ask that before you ask what the agent can do, and push vendors toward the specialist-dot and Autopilot model, where the enterprise is the policy source.

If you’d like help working through this for your own environment, our free Agentic AI Security Workshop covers how to classify the agents your employees are already using and where your existing controls apply. Contact us to schedule one .

References

Book the Author

Want to bring these ideas to your audience? Jason Garbis speaks at conferences, webinars, podcasts and corporate events. He shares practical, vendor-neutral guidance on building Zero Trust programs, from getting started to securing the AI era. Send an e-mail to info@numberlinesecurity.com.

https://www.linkedin.com/in/jasongarbis