Enterprise AI Agents Enter Systems of Work: Who Controls Context, Action, and Accountability?

The contest is shifting from chat entry points to systems of work

China's enterprise-AI race first looked like a contest for the best assistant and then for the dominant office entry point. Releases through mid-October 2026 point to a deeper shift: agents are being placed inside the systems where employees authenticate, retrieve company context, approve work, operate merchant accounts, and return results.

The advantage is straightforward—fewer handoffs and richer authorized context. The control problem is harder. An agent that can read meetings, edit documents, inspect merchant data, or trigger a workflow needs scoped permissions, evidence trails, revocation, portable records, and a way to connect compute cost with completed work. The thesis here is therefore narrower than a productivity claim: the competitive layer is moving into systems of record and action, while proof of durable return remains limited.

WorkBuddy and WeCom compress the handoff between context and execution

Tencent's October 14 documentation describes WorkBuddy and WeCom as a two-way joint version using the WeCom account system. Within enterprise authorization, WorkBuddy can work with messages, documents, meetings, and WeCom cloud-drive content, then return task output to WeCom. This is a deeper integration than placing a chatbot beside the collaboration suite: identity, context retrieval, execution, and delivery sit in one operational loop.

The release should not be read as WorkBuddy's first connection to WeCom; earlier public material already described basic integration. The incremental signal is the shared account system and expanded two-way workflow. The documentation establishes available capabilities, not adoption, task accuracy, or the frequency of excessive-access events.

This design can reduce copying between tools, but it also concentrates control. Buyers need item-level authorization, clear notices when an agent crosses application boundaries, logs that show which source supported each action, and export paths for task history and reusable workflows. Without those controls, convenience can turn into platform lock-in or invisible permission expansion.

QwenWork is moving from generic office work into merchant operations

QwenWork's October 14 update opened invited testing for an individual-edition e-commerce mode. The product page describes cross-platform operating dashboards, trend and selling-point analysis, content generation, and ROI optimization, supported by connections to Alibaba merchant systems including Business Advisor, Qianniu, and Alimama. The enterprise edition was not yet open.

The strategic move is from answering questions about work to acting on operating data inside a defined vertical. Merchant systems contain inventory, campaign, customer, and performance context that can make an agent more useful than a stand-alone assistant. They also make attribution harder: an improved campaign may reflect the agent, a price change, channel traffic, seasonality, or human judgment.

Invited testing establishes neither cross-platform neutrality nor commercial impact. The important follow-up is whether connectors extend beyond Alibaba's own stack, whether merchants can inspect and export the data and instructions behind a recommendation, and whether reported ROI is calculated against a documented baseline with all media and inference costs included.

Feishu and Meituan show two other routes into operational context

Feishu 8.0 expanded agent-facing CLI functions and introduced Doubao Work Partner with team identity, permissions, memory, centralized access management, audit, and AI-usage controls. This is the collaboration-suite route: the agent inherits the workplace's directory, documents, conversations, and administrative boundary. The team agent remained in directed co-creation at launch, so general availability and repeatable team outcomes are still unproven.

Meituan represents a different route. Its CatPaw work points to a shared internal agent foundation, while public company figures for Smart Shopkeeper, Kangaroo Manager, and Xiaotuan show agents being attached to merchant and consumer workflows in local services. These products are not one unified architecture in the public record, and company-reported reach or request counts do not establish incremental profit, accuracy, or retention.

Across both routes, context becomes an operating asset rather than disposable prompt history. The governance questions converge: who can attach a source, how freshness is checked, which actions require confirmation, how a reusable procedure is versioned, and whether an administrator can reconstruct and reverse a consequential action.

Organization, cost, and lifecycle still determine whether the layer is governable

Kuaishou's cross-business Enterprise AI Productivity organization assigns ownership for office infrastructure, general-purpose agents, enterprise context, and internal information systems above any single assistant. A separate report that Alibaba shifted some token costs toward business-unit budgets points to the economic counterpart: teams may increasingly own both the workflow and its inference bill. The Alibaba policy remains a single-origin report without public confirmation and should not be treated as settled company-wide policy.

Lifecycle is the third constraint. Tencent Cloud's retirement of legacy model APIs and Alibaba Cloud's OpenSearch lifecycle notice show that an agent workflow can change when an underlying model or service is replaced. Even a compatible interface may change quality, latency, safety behavior, context limits, or price. A governable system therefore needs named owners, model and connector inventories, evaluation baselines, migration windows, traffic-switching plans, rollback criteria, and post-incident review.

• Identity and permission: which person or agent may read, decide, and act.
• Context provenance: which data, memory, and intermediate work supported an action.
• Workflow control: how procedures are versioned, tested, approved, and rolled back.
• Portability: whether records, instructions, and evidence can leave the platform.
• Economics: task-level usage, budget allocation, exception approval, and total cost.
• Accountability: accepted output, defects, incidents, human takeover, and named owners.

What would weaken the thesis

The thesis would weaken if the joint products remain lightly used, vertical agents cannot outperform generic assistants on completed tasks, platform connectors stay shallow, permission or stale-context incidents rise, customers cannot export records, or operating teams route around official systems because controls are too rigid.

The most useful follow-up evidence is operational: weekly active teams rather than invited accounts, end-to-end completion without manual copying, cost per accepted task, permission denials and excessive-access incidents, stale-context errors, human-takeover rates, rollback frequency, export success, model-migration failures, accepted output, escaped defects, and cycle time. Until comparable indicators appear, the public record supports a shift in product architecture and management intent—not a claim that enterprise agents have already delivered broad ROI.