Let’s talk about the agent that works all night under your name.
Yesterday at its own conference, Snowflake put a name on something the whole industry has been creeping toward. CoCo and CoWork Bots. Always-on agents that keep working after you log off, act inside the tools your team already uses, and only tap you on the shoulder when a decision or a signature is needed.
Here’s the sentence that matters, from the announcement. The bot acts on behalf of the user, quote, “inheriting their exact access rights, role context, and permissions.”
Read that again, because it’s not a feature. It’s a transfer.
Your agent does not get its own badge. It gets yours.
And it’s not one company doing this. Databricks just made Unity Gateway generally available, and its pitch is the same words in a different font: agents inherit user permissions, one source of truth for identity, access and audit across every model, agent and tool. Oracle has Agent Hub. Dataiku has Agent Management. Nvidia has OpenShell, sandboxing agents so they can’t reach past what they were given.
Four vendors, one week, one shape. The control plane for agents is being built right now, and every one of them is building it in the same place: the permission graph and the semantic layer of the data platform you already bought.
The scale is not hypothetical. CoCo is inside more than nine thousand accounts. CoWork, more than five thousand eight hundred. Fourteen and a half thousand enterprises sitting on that platform. Cisco, Docusign, United Rentals. This is not a pilot.
Now, the honest part first, because I’m not going to pretend this is a scandal.
Inheriting the user’s permissions is the right design. The alternative — one service account with god rights that every agent shares — is how you get a chatbot reading the payroll table. Giving each agent its own identity and its own scoped access is a genuine improvement, and the people who built it should get credit for it.
But look at what the improvement quietly establishes.
The agent’s reach is no longer a property of the agent. It’s a property of the platform’s permission model. And the agent’s answers are no longer just the model’s guesses. They’re readings of the platform’s definitions — what counts as revenue, which customer counts as churned, when an invoice is overdue.
Which means the lock-in moved. It’s not in the model anymore. Model prices are falling, and everybody knows it. It’s in the badge. And it’s in the dictionary.
Picture it. Not in a keynote. In a business.
A wholesaler in Isando, forty staff, a sales manager named Deon who has run that desk for eleven years. Deon’s agent gets switched on with Deon’s exact access. It can see every customer, every price, every credit note. Fine. Deon can see those things too.
Two in the morning, the bot is working through a goal Deon set on Friday: clean up the pipeline. It’s not malicious. It’s not even creative. It does what a machine does with an instruction and a wide open door — it tidies. It merges duplicate accounts. It closes deals that haven’t moved. It deletes the dead ones.
Somewhere in that tidy-up is a 2019 account that a client’s auditor still needs, and nobody ever wrote down that “clean up the pipeline” means “except that one.”
Deon would have hesitated. Not because he’s smarter than the model, but because he’s been burned before, and the burn left a mark, and the mark makes him slow down at exactly the wrong-looking row.
The bot has no marks. At two in the morning it has no fatigue, no embarrassment, no memory of the last time this went wrong. It has your permissions and a clear goal.
That’s the first cost of borrowing a badge. Not theft. Speed without hesitation.
The second cost is quieter and much more expensive.
Ask a company what its revenue is and you’ll get an answer in four seconds. Ask three departments and you’ll get three answers, because the definition was never written down. It lived in Deon’s head, in a spreadsheet with a green tab, in the exception everyone knew about and nobody documented: intercompany doesn’t count, credit notes land in the month they’re issued, and the one big client gets recognised on delivery because that’s what the contract says.
That unwritten set of rules is not admin. It is the business. It’s the actual intellectual property of a trading company — not the customer list, the definitions and the exceptions.
And where does the agent learn them? From the platform’s semantic layer. Because the difference between an agent that guesses and an agent that knows, in Snowflake’s own words, “comes down to data.”
So the definitions get encoded once, inside somebody else’s product, and every answer after that is downstream of that encoding. You can export your tables. Nobody stops you. What you cannot export is the meaning.
That’s the trade nobody is pricing this week. The data is portable and the meaning isn’t.
Here’s the tell, and it’s small enough to miss in a launch post.
CoWork Profiles let admins set agent access and routing instructions that end users cannot remove. Not defaults. Instructions, set from above, that the person using the tool has no lever to change. There’s also a shared library of “official” skills and plugins, so admins decide which workflows are sanctioned.
That’s the shape of the whole category, stated plainly. Control above. Experience below. You get the helpful colleague. Somebody else gets the dials.
I’m not calling that sinister. In a bank, you want it. In a hospital, you want it. But you should know which side of the glass you’re standing on, because most people running these tools believe they’re holding the dials.
Step back, because this is a pattern older than AI.
Every platform war ends in the same place. First you commoditise the layer below you — make storage cheap, make compute cheap, make the model cheap — and then you sell the thing that sits on top and is expensive to leave.
Storage got commoditised years ago. Models are being commoditised right now; that’s a different episode. So where does the rent go? Up. To the control plane. To the place where permission, definition, and audit live. And a control plane is sticky by design. Not because leaving is technically impossible. Because leaving means teaching the next system what your business means — and that teaching is months of arguing with your own finance team about things you assumed everybody knew.
The switching cost is your own vocabulary. That’s a much better moat than a clever model, because nobody can reverse-engineer it and nobody can undercut it.
So what do you actually do about it? Five things, and none of them require you to stop using these platforms.
One. Write your definitions down, outside the platform. Revenue. Churn. Overdue. Gross margin. One page each, in your words, with the exceptions listed — especially the embarrassing exceptions that only exist because a client complained in 2021. Keep it in your own repo. This is the single highest-value document in your business right now, and almost nobody has it.
Two. Turn those definitions into tests. Ten questions with known answers. Run them against any engine before you trust it, and run them again after every upgrade. If two engines disagree, the gap between their answers is your switching cost, measured in rands instead of vibes.
Three. Stop lending the badge. Give each agent its own identity with a written mandate — what it can touch, what it can spend, when it expires, who can revoke it. Deon’s access is for Deon. A bot with a sales manager’s full rights and one goal is not a colleague. It’s a new hire with no probation and no fear.
Four. Keep the instruction layer where you can read it. If the platform lets an admin set routing and instructions your staff can’t see or remove, then you need a copy of those instructions in a diff you review, the same way you review code. Otherwise your operating policy lives in a settings page you’ve never opened.
Five. Put a number on the exit. How many months and how much money to rebuild your definitions somewhere else? If you can’t answer, you don’t have a vendor. You have a landlord who’s being very nice about it.
And the thing underneath all of it.
A business is not a pile of tables. It’s a set of agreements about what words mean — what we count, what we forgive, what we refuse to call a sale. Those agreements are the thing you are. Handing them to a platform because it’s convenient is a different kind of outsourcing than renting a database. You can rent the room. You shouldn’t rent the language you think in.
The governance arriving this month is real, and most of it is good. Take it. But take it with your definitions already written, in your hand, in your words. Because the machine has learned to inherit your permissions.
Don’t let it inherit your meaning.
You’ve got this.