Risk · 02
Autopilot arrives as another identity
Autopilot, previously Scout, is meant to keep working after the person has closed the chat. Microsoft's 25 September 2026 account of it gives the agent its own tenant identity, memory, computer and workspace, and shows it in places such as Teams and Outlook. That is a different risk from a reply you can delete.
What private preview is
Microsoft said private preview would expand at the end of September. It also said the user sets the objective and the boundaries, and earlier Scout material described approval for sensitive actions. None of that is a production agent with a free hand.
What has to be named first
A persistent agent can notice a missed update without a new prompt. That is also continued access. Before anyone asks to join a preview, name the role, the permission boundary, the log, and the person who can stop it. If those four are missing, the preview is a demo of trust you have not earned.
How a fictional board refuses the shortcut
In the FrontierOrg method, which is fiction, the board's first answer to a request for an autonomous scheduling agent is a narrow discovery, not unattended customer messages. The fictional risk lead asks what an unsafe promise looks like before anyone measures speed.
Monday
Write one sentence: the only recurring task you would let a preview agent touch, and the action it must not take. If you cannot finish the sentence, you are not ready to ask for the preview.
Who is on the hook when the agent follows up with a supplier you did not mean to chase?
Sources: Microsoft blog, 25 September 2026, Introducing the new Copilot with Home, Code and Autopilot (opens in a new tab). Microsoft, 2 June 2026, Introducing Microsoft Scout (opens in a new tab).
Where this note mentions FrontierOrg, that is a fictional method for rehearsing a decision. It is not a company, not a client, and not a case study.