---
title: "Autopilot keeps working after the prompt ends. Govern the persistent identity, not the chat."
description: "Microsoft's new Autopilot has its own identity, memory, computer and workspace and can run recurring work unattended. Enterprise controls now need to follow the agent between prompts."
url: "https://devencelab.com/insights/2026/09/27/autopilot-keeps-working-after-the-prompt-ends-govern-the"
date: "2026-09-27"
section: "Insights"
tag: "Agentic AI"
author: "Devence Lab"
reading_time: "2 min read"
site: "Devence Lab"
license: "Readable and quotable with attribution to the canonical URL."
---

# Autopilot keeps working after the prompt ends. Govern the persistent identity, not the chat.

Microsoft's new Autopilot has its own identity, memory, computer and workspace and can run recurring work unattended. Enterprise controls now need to follow the agent between prompts.

Microsoft's 25 September Copilot announcement gives Autopilot four things that ordinary chat sessions do not have together: its own identity, memory, computer and workspace. It can watch channels, follow up on threads, run recurring work and resume projects days later without waiting for another prompt.

That changes the control problem. A chat assistant mostly acts while a person is present. A persistent agent can retain context, revisit systems and initiate work while the requester is elsewhere. Governance therefore has to survive the gap between the original instruction and every later action.

## The security principal outlives the conversation

Microsoft says Autopilot lives inside the tenant and operates with permissions, audit and governance behind it. That is the right architectural direction, but it also means administrators should treat the agent identity as a durable principal rather than an extension of the user's current session.

The distinction matters because the agent can participate across Teams, Outlook, chats, channels and documents. Microsoft also says plugins will provide trusted connections to actions and data, while IT can approve and manage those plugins centrally. Each added plugin expands what a persistent identity can reach after delegation.

> A persistent agent should inherit an objective, not an indefinitely reusable copy of the user's authority.

## Recurring work needs recurring authorisation

A supplier-review example in Microsoft's announcement shows the agent building a schedule, preparing meetings, following up and contacting stakeholders for updates. Those are separate actions occurring over time. A single approval at task creation should not automatically answer whether every later write, message or data access remains appropriate.

Enterprise policy should bind the agent to an explicit owner, approved connectors, data scope and action classes. High-impact writes should require a fresh policy decision or confirmation. Credentials should be scoped to the agent's role, not copied wholesale from the delegating user. Expiry and revocation need to terminate unattended work predictably.

## Audit the gaps between prompts

Microsoft says Autopilot keeps users informed and in control. Security teams should make that measurable before broad deployment: record which identity initiated each action, which plugin or tool executed it, what resource was touched, which policy allowed it and whether the action occurred while a human was actively supervising.

The release gate should include persistence tests. Revoke a connector after a task begins. Change the owner's access. Remove the agent from a group. Let a recurring task wake after those changes. The acceptable result is not merely a readable audit log; the next action must be evaluated against current authority rather than stale delegation.

## Sources

- [Introducing the new Copilot with Home, Code and Autopilot](https://blogs.microsoft.com/blog/2026/09/25/introducing-the-new-copilot-with-home-code-and-autopilot/) - Microsoft