# How to run personal agents securely at work

> Personal agents need identity, permissions, and audit at work. See how Factory runs delegated and automated agent work under organization controls.

URL: https://factory.com/articles/model-agnostic-openai-dots-alternative
Published: 2026-09-29
Updated: 2026-10-23

Personal agents are now a product category. OpenAI dots, Meta Muse, Claude Duet, and Grok Bot each give one person an always-on agent with its own computer, connected apps, and background work. The guide to [OpenAI dots and personal agents](https://factory.com/articles/what-are-openai-dots) covers how they work and where they differ.

Bringing that pattern into a company adds requirements. The agent needs an identity the organization controls, access scoped to the work, limits that individual users cannot loosen, and a record security teams can review. Factory runs delegated and automated Droid sessions inside those controls, for engineering work that starts in Slack, issue trackers, and repositories.

## Decide whose identity the agent uses

Every agent at work acts as someone, and Factory decides it per conversation. In [Slack](https://docs.factory.com/delegations/slack), a direct message to Factory runs as the person who sent it, with their personal Git credentials and connected apps. An `@Factory` mention in a channel runs as the service account in the organization's shared Apps configuration, with that account's credentials and connectors. Mentioning Factory in a channel does not pass the sender's personal connectors to the shared session.

[Service accounts](https://docs.factory.com/enterprise/identity-and-access#service-accounts) are non-human identities that authenticate with their own Factory API key. Sessions, computers, billing, and audit events are attributed to the service account instead of a teammate. Only Owners and Managers can create or edit them. Business and Enterprise plans can create service accounts for any workload, and individual plans and the Teams plan include one, reserved for Delegations.

Service accounts also fail closed. They never inherit organization OAuth credentials for self-managed source control. If a GitHub Enterprise Server repository lacks a matching GitHub App installation, Factory stops the operation instead of running it with a human user's access.

## Delegate from Slack and issue trackers

[Delegations](https://docs.factory.com/delegations) let a team send work to Droid from Slack, Linear, and Jira, with Microsoft Teams support in development. An administrator configures the shared instructions, plugins, service-account identity, and compute once. Team members then mention `@Factory` in a thread or assign an issue, and Droid investigates, implements, and tests the change on a remote computer. Progress and results come back to the same conversation.

The shared configuration carries organization policy into every delegated session. A plugin disabled organization-wide stays disabled even if the delegation configuration lists it. Team members can set personal defaults for model and instructions, but a personal model applies only when organization policy allows it, and personal instructions are added after the shared ones without replacing them.

Start with a small, reviewable request. Name the repository, the outcome, and how Droid should verify it. Asking Droid to fix a failing test, run the relevant suite, and open a pull request with a summary gives the team a concrete result to review before anything merges.

## Run recurring work on Automations and Droid Computers

Some agent work should start from an event or a schedule instead of a message. [Custom Automations](https://docs.factory.com/software-factory/automations) start a Droid session when a trigger fires, on a schedule, when a message lands in a Slack channel, on a GitHub event, or from an inbound webhook. Webhook triggers are in private preview. Starters cover jobs such as hourly error triage that opens a fix pull request when safe, a Slack bug fixer, and a weekday code health pass.

Each automation names its run identity, run target, and session privacy. A run acts as the automation's owner, or Managers and Owners can pick a service account so the run uses that account's connectors and billing. Session privacy decides whether only the run identity or the wider team can open the sessions a run creates. Factory pauses an automation automatically after five scheduled runs in a row fail.

Delegated and automated sessions can run on [Droid Computers](https://docs.factory.com/droid-computers/overview), persistent machines that Factory hosts and maintains. Files, packages, running services, and configuration carry over between sessions. Managed computers pause when idle and resume when a session targets them. A service account can own its computers, which keeps long-running work under the same identity.

On the network side, managed Droid Computers block inbound traffic except the daemon port by default, and organizations can turn on relay mode for a stricter network-level boundary. Teams that want work on a machine they already manage can register a cloud VM, workstation, or on-premises server with [Remote Control](https://docs.factory.com/remote-control). That machine needs network access to Factory's services and relay, and its hardening stays with your team.

## Set limits users cannot override

Personal agents follow rules their owner sets. At work, some limits have to hold regardless of user settings. Factory's [Enterprise Controls](https://docs.factory.com/enterprise/hierarchical-settings-and-org-control) separate hard controls from session defaults. For hard controls the organization level is authoritative, and lower levels can extend a policy but never weaken or remove it. Administrators use them for model access, command rules, sandbox settings, and managed hooks.

[Permission rules](https://docs.factory.com/autonomy-and-safety/permission-rules) decide each shell command as allow, ask, or block. A block rejects matching commands with no approval path, even when a session skips permission prompts. An ask requires approval even at High autonomy. Administrators can also require that only organization-managed hooks run, and Droid Shield scans git commit and push operations for secrets and credentials.

Factory's documentation notes that command rules are not a sandbox, and recommends pairing them with sandboxing, managed hooks, and least-privilege credentials. The same advice applies to any personal agent with access to company systems.

For review, the [audit log](https://docs.factory.com/enterprise/audit-log) records organization events, including service account changes, API key creation and deletion, integration changes, and updates to managed settings. It is available to Enterprise organization owners in the web app and through the public API.

Approvals then follow the team's existing process. A delegated session can prepare and test a patch as a pull request, and the team can keep merges behind its usual branch protection and code review. Use an ask rule for commands such as a push to the main branch, and block commands that should never run.

## Choose models within policy

Dots run on GPT-6 Astra, as the [dots guide](https://factory.com/articles/what-are-openai-dots) notes. Factory is model-independent. [Factory Router](https://docs.factory.com/model-independence/factory-router) selects a model automatically based on quality, latency, cost, and cache state, and a delegation configuration can leave its model on Auto Model to use it.

[Custom Models](https://docs.factory.com/model-independence/byok) let the Droid CLI and desktop app use provider keys, compatible endpoints, and local models. Custom configurations are not available in the hosted web or mobile products, and Enterprise Controls can restrict custom models, base URLs, and provider access.

Model choice matters most when it has to fit governance. Blackstone wanted flexibility across model providers within its existing controls. Monty Hall, CTO of Data, Cloud and Developer Experience at [Blackstone](https://factory.com/case-studies/blackstone), describes the requirement: "We didn't want lock-in with any single lab or provider and thus constrain innovation. We also have very strict controls around governance and security."

To pilot personal agents at work, start with one Slack channel and one service account. Give the account access to one repository, add an ask rule for pushes, and review the first delegated pull requests before widening access or adding Automations.

## Frequently asked questions

### How can a company run personal agents securely?

Give each agent an identity the organization controls, scope its credentials and connected apps to the work, enforce limits users cannot override, keep an audit trail, and require approval for consequential actions. Factory supports this with service accounts, Enterprise Controls, permission rules, and an audit log for Enterprise organizations.

### Whose identity does a Factory delegation use?

A Slack direct message to Factory runs as the sender, with their personal Git credentials and connectors. A channel request, or a delegated Linear or Jira issue, runs as the service account in the organization's shared Apps configuration.

### What can start a Factory automation?

Custom Automations start Droid sessions on a schedule, from a Slack message, on a GitHub event, or from an inbound webhook. Webhook triggers are in private preview. Each automation runs as its owner or as a service account.

### Which models can Factory agents use?

Factory Router selects models automatically based on quality, latency, cost, and cache state. Custom Models let the Droid CLI and desktop app use provider keys, compatible endpoints, and local models. Custom configurations are not available in the hosted web or mobile products.

### Is Remote Control an airgapped setup?

No. Remote Control requires network access to Factory services and relay, so it is not an airgapped configuration.

## Further reading

- [OpenAI dots vs coding agents for engineering teams](https://factory.com/articles/what-are-openai-dots)
- [Least-privilege access for coding agents](https://factory.com/articles/least-privilege-coding-agents)
- [Audit trails for coding agent changes](https://factory.com/articles/coding-agent-audit-trails)
- [Factory Delegations](https://docs.factory.com/delegations)