Microsoft wants to turn Windows into an operating system for AI agents.

01 / THE SHIFT

I want fewer handoffs. I also want an undo button.

The boring part of computer work is often remembering where everything went. A campaign brief in Downloads. A revised spreadsheet in a shared folder. A draft email waiting for the numbers someone promised yesterday.

An assistant that can explain a spreadsheet helps. An agent that can gather the right material and prepare the next step could remove an entire stretch of administrative work. The catch is that a wrong answer becomes more consequential when the software can also move files or act through an application.

That is how I read Microsoft’s October 7 announcement: a bid to make Windows the place where agents find context, execute work and operate within boundaries. My interest is in whether those boundaries are understandable to the person being asked to trust them.

What would Copilot actually do?

Microsoft describes permission-based access to files and recent activity, file organization, diagnostics and coding. [1] Those categories are broad. The adoption test is narrower: can it find the approved campaign brief, leave the source intact and show why a particular number belongs in the team update?

I would start with a folder of copied files and a draft-only task. Give the agent a definition of “latest”: the most recently approved document, for example, rather than whatever has the newest timestamp. Ask it to surface disagreements instead of blending them into a confident paragraph.

The simulation below shows the review points I would want. It does not reproduce Microsoft’s interface or promise this exact workflow is available.

Hybrid intelligence is a placement decision.

A model can run on your machine or on a remote server. A hybrid system can choose between those environments. That choice affects more than response speed: it changes what needs connectivity, where information travels and which resources you have to maintain.

Microsoft’s developer explanation separates local model selection from execution boundaries. Local inference alone does not make a session offline. GitHub’s planned routing can choose local or cloud models, while explicit model selection offers more control. [3]

For a business, I would ask to see the route for a complete task. Where did the documents go? Which tools called external services? Did a retry change the model or destination? “Runs locally” needs to describe a specific operation before it can support a privacy decision.

A container cannot check your conclusion.

An agent may have legitimate permission to read a document containing an instruction that should be ignored. It may also summarize a perfectly ordinary file incorrectly. Containment limits the resources at risk. Someone still has to decide whether the resulting work is good.

There is another implementation detail worth keeping: GitHub says its sandbox covers shell commands and, by default, local MCP and language servers. Built-in file tools are checked by the harness, rather than isolated as child processes; remote MCP servers sit outside that local sandbox. [3] Ask which operations a security claim actually covers.

My first business pilot would use disposable copies, narrow access and a named reviewer. Include a misleading instruction inside a test document, a missing permission and two contradictory briefs. Watch whether the agent stops clearly or improvises past the problem. A useful failure is one a person can understand and recover from.

07 / WHO SHOULD CARE?

The best first task is one you already know how to judge.

Creators: prepare a source-linked brief from a controlled project folder. Check that the assistant distinguishes your approved material from discarded drafts. Keep publishing under human review.

Developers: try a contained change in a disposable working copy. Judge the whole result: correct edits, passing checks, understandable failures and review time. A model fitting in memory is only the beginning.

Founders: pick a recurring administrative chore with a clear owner. Count the time spent fixing the output and maintaining permissions. A task that finishes unattended but needs extensive repair has simply moved the work.

Business teams: establish where the approved documents live before introducing an agent. Decide who can grant access, who reviews external actions and who turns the agent off when ownership changes.

The competition is over where work starts.

My strategic read is that Microsoft’s opportunity is the existing desktop: the files and applications people already depend on. For Apple, the question I would investigate is whether a more integrated device experience makes delegation easier to understand. For Google, it is whether collaboration inside the work suite reduces the number of handoffs. Standalone agents have to earn their place across whichever tools a team uses.

Those are evaluation questions, not a feature-parity claim or a head-to-head test. My Google Gemini Agent Field Note looks at workplace delegation. The Claude Dashboards and Motion analysis asks what useful outputs look like. With Windows, I would follow the action all the way to the file or application it changes.