Here’s a question I don’t think many businesses have asked yet. When you hire your next person, will they be allowed to bring their own agents with them? And when someone leaves, will you let the agents they built in your business walk out the door too?
For years we’ve treated a worker’s toolkit as personal. Their know-how, their shortcuts, their way of working. Agents blur that line badly. An agent can hold skill, but it can also hold memory, data and relationships. That makes the answer far less obvious than it first appears.
The toolkit versus the tenant
I think the cleanest way to start is to split an agent into two parts.
The first part is the pattern. The prompts, the instructions, the way someone has learned to break a job down and hand it to AI. That’s skill. It lives in their head as much as anywhere, and I don’t believe a business can or should claim it. A good tech who has learned how to direct agents well will carry that ability to their next role, the same way they carry their troubleshooting instincts.
The second part is the data. An agent built in Copilot Studio inside your Microsoft 365 tenant, grounded on your SharePoint libraries and connected to your systems, belongs to the tenant. So does what Copilot remembers about how a person works. Microsoft stores Copilot memory in a hidden folder in the user’s Exchange mailbox, inside your tenant, and admins can find it with Purview eDiscovery. That’s a pretty strong hint about where ownership sits.
I wrote recently about the mystery of personal SharePoint skills, which end up stored in a user’s OneDrive. Personal in name, but still sitting in the company’s tenant. Expect a lot more of that.
Memory is where it gets messy
Picture a consultant who has spent two years working with an agent. It knows her clients, their quirks, which contracts are touchy and which projects ran late. Now she moves to a competitor. Should that memory go with her?
My view is no, and not because the business is being greedy. That memory is tangled up with client data, confidentiality obligations and, in many cases, data residency requirements. You can’t neatly pull “how she works” out of “what she knows about our customers”. Until the tools can genuinely separate the two, the memory has to stay.
Treat BYO agents like BYOD
Bringing your own agent in the other direction feels a lot like the early days of bring-your-own-device. The answer then wasn’t a flat yes or no. It was policy, identity and control. Agents need the same treatment. Whose identity does it run under? What data can it reach? Where does what it learns end up? If you can’t answer those, the agent shouldn’t touch your tenant.
What I’d do now
None of this is legal advice, and your lawyer will have views. But there are practical steps any SMB or MSP can take today:
- Write a simple agent policy covering who can build, bring and share agents.
- Keep an inventory of every agent, with a named human owner.
- Add agents and AI memory to your offboarding checklist, right next to mailbox and device handover.
- Update employment contracts to say what’s portable and what stays.
- Decide upfront that skills and prompt patterns travel, while data and memory stay put.
The people who learn to work well with agents will be worth more wherever they go. That’s fine. Let them take the skill. Keep the data. Just make sure you’ve written down which is which before someone hands in their notice.
