Deep Dive — ByteDance hands its agents an employee badge

On Tuesday in Beijing, ByteDance gave its AI agents something no model release can grant: a seat in the org chart. Feishu 8.0 rebuilt the collaboration suite around agents, and a new product — Doubao Workmates — gives a team agent its own identity, its own permissions and a memory it shares with everyone in the room.

The interesting part is not that an agent can be added to a group chat. It is what the company had to build underneath to make that safe, and what it still hasn't said about how any of it gets taken away.

The badge

Doubao Workmates, launched at the Feishu Future Unlimited conference on September 15, is a team agent rather than a personal one — the distinction ByteDance's product managers kept returning to. It has an independent identity, its own permission set and its own memory, and it joins a Feishu group chat the same way a colleague does. Once it is in, every member of the team works with the same agent instead of each person configuring a private assistant: shared skills, shared context, one entity that accumulates what the group discusses.

It is not a chatbot waiting for instructions. In the demo, a Workmate spotted a problem in a project, diagnosed it and went to fix it unprompted. When it hit a task that required authorization above its own level, it asked a higher-privilege member of the group for approval and reported the answer back into the thread rather than stalling. Feishu's pitch is that this is what separates it from the group-chat bots companies have been wiring up for years: those wait to be tagged, this one tracks the work.

Feishu 8.0 is the substrate. The collaboration suite now exposes 767 function points to agents through its command-line interface, up from 247 when that CLI launched in March, with the call success rate improved from 78% to 95% and call speed up 39%, according to figures Feishu CEO Xie Xin presented on stage. A Feishu agent can draft documents, operate multi-dimensional tables, schedule meetings, join calls, read cloud drives and drive approval workflows — essentially, the company says, anything an employee can do in the product. Agents can also tag each other to split work inside a group.

Governance is where the design gets pointed. In Feishu 8.0, an agent's permissions always match the permissions of the person using it: if an employee cannot see a document, neither can the agent. Administrators can inventory agents, trace their usage, cap token consumption by department or individual, and throttle expensive models and scenarios. The company is selling the control plane as the product, not the model behind it.

One product line, two permission models

ByteDance shipped both answers to the enterprise-agent permission question in the same keynote, and they disagree with each other.

Doubao Work, the company's personal productivity agent that we covered when it launched with native Feishu wiring in August, inherits the requesting employee's identity. Its access is that person's access, down to their seniority level, and personal and enterprise data are held separately with enterprise data excluded from training. That model is familiar and easy to audit: the agent is a mask you wear.

Workmates runs the opposite way. Its whole value proposition is that one agent serves a whole team, so there is no single user whose credentials it could borrow — which is precisely the argument Anthropic made in June when it put Claude inside Slack as a taggable teammate. Noah Zweben, on Anthropic's Claude Code team, wrote at the time that agents now schedule work and respond to events long after the person who asked has logged off, and that in a shared channel with multiple people steering, there is no user whose identity makes sense to inherit. Anthropic's answer was to give Claude its own accounts, with administrators scoping access per channel and setting spend ceilings, so that a shared channel can never become a side door into someone's private files.

That is the same conclusion Feishu reached, and it is the harder one to operate, because an independent identity has to be granted, scoped, reviewed and — this is the part nobody has demonstrated — revoked. Feishu's own materials describe how a Workmate gets permissions and how it escalates when it lacks them. Nothing in the launch materials describes what happens to a shared memory when the access that produced it is withdrawn.

The memory is the load-bearing part

Here the published research is less reassuring than the keynote. A paper posted to arXiv on September 8 and updated through early September, "Revoked but Still Authoritative," measured revocation enforcement across five production agent-memory systems — Graphiti and Zep, which share one engine, mem0, langmem and cognee — with nine policy scenarios and nine models from six vendors, scored under six defense conditions from no defense up to a retrieval-time validity check.

The setup is mundane in the way that makes it worth reading. Instead of an attacker poisoning the store, a benign user simply supersedes a policy: the old version is marked invalid and retained, which is how these systems version history. The question was whether the invalidation mark is enforced when the agent reads.

It is not. Across the systems tested, no memory backend enforced revocation by default: revoked records came back, outranked their replacements, and led the agent into the unsafe action. Only two of the five returned both the revoked record and its replacement — and in every scenario tested, both ranked the revoked record above the current one and drove the agent to act on it in more than two of every five trials. The authors built a guard that sits between agent and memory backend and withholds records that are revoked or conflict with their replacement; it works wherever the backend's revocation label survives to retrieval time. The pattern of failure has three shapes: revocation never recorded, recorded but invisible to the application, or recorded, visible and simply not enforced.

Map that onto what Workmates is selling. The product's headline feature is institutional memory that outlives individual employees — a colleague teaches it a skill and everyone gets it, and when a person leaves, the knowledge stays. That is a real problem worth solving, and it is also a store of internal facts with an authority that no one is currently obliged to expire. Access control in an enterprise is dynamic: people change teams, projects wind down, policies get rewritten. If an agent's memory keeps the version of reality it learned inside a project that has since changed its rules, the study's finding predicts the failure mode — stale but confident, and ranked above the update.

Neither ByteDance nor Anthropic has published deletion, expiry or revocation semantics for team-agent memory, and both products are too new for an independent auditor to have looked. That is not proof of a defect; it is the absence of an answer to the one question a compliance officer will actually ask.

The org chart is the moat

The competitive context explains why model capability is no longer the pitch. Feishu's first-half 2026 annual recurring revenue grew at 2.5 times the prior-year pace, the fastest since the product was founded in 2016, with more than 90% of new customers buying AI products alongside the suite and small and midsize customer count up 70% year over year, according to the company. Doubao's consumer app has 382 million monthly active users and ByteDance says its model business annualized above $4 billion in July on consumption — figures that make Feishu's sales organization the delivery channel for a model business, which is exactly why CEO Liang Rubo merged Doubao, Feishu and Volcano Engine into one unit two months before the keynote and appeared in person to close the integration.

The rivals are converging on the same insight from different directions. Tencent's WorkBuddy hit 20.97 million monthly visits in June, more than ByteDance's Trae at 12.79 million and Alibaba's QoderWork at 7.88 million combined, and Tencent has reportedly put close to a billion yuan into offline advertising for it. Alibaba consolidated three separate agents into Qianwen Office and opened a public beta in early August — the platform that has been adding open-weight models from Zhipu and DeepSeek as interchangeable parts. Baidu renamed its general agent and claims more than 25 million monthly active users across its office products.

When the model layer commoditizes — and in China it has, with frontier-weight models available under permissive licences — the scarce assets become organizational context and the permission system that governs it. Which company you work for, where the data sits, who holds access, and where a workflow routes next. Feishu has ten years of enterprise deployments to draw that from, including a customer list that now runs from automakers and consumer brands to chipmakers and model labs. ByteDance's bet is that owning all four layers at once beats owning the best model.

What the skeptics should press on

Three things are being asked to the reader's trust rather than shown. First, every performance number in the launch is vendor-supplied: the 767 function points, the 95% call success rate and the 39% speed gain come from Feishu's own instrumentation, with no external reproduction. Second, Workmates is not generally available. The company describes it as in targeted co-creation with selected enterprises, to be opened to customers gradually, which means the demo behavior — the agent that self-assigns a fix, the agent that requests elevated permission — has not been running against a stranger's messy permission graph. Third, the interesting failure modes of an agent with an independent identity are organizational rather than technical. An identity that persists after its creator leaves is a standing credential; a shared memory is a system of record that no one has agreed to maintain.

There is a fair counter-argument: Feishu's inherited-permission model for individual agents is stricter than most enterprise deployments manage with human contractors, and an agent that must ask a senior colleague for permission to cross a boundary is more auditable than one silently holding broad credentials. The design is defensible. The gap is that the industry has spent two years building agent memory and almost no time building agent forgetting.

What to watch

Whether Workmates reaches general availability with a stated retention and revocation contract for shared memory — and whether an administrator can expire a team agent's knowledge the way they can expire an employee's access. Whether Tencent and Alibaba answer with an independently identified agent rather than a scoped personal one; WorkBuddy's channel advantage inside WeCom makes that a natural move. And whether the 767-function CLI count becomes the industry's scoreboard the way context windows once were, because it measures something more useful: how much of a company's real work an agent is allowed to touch.

If an agent remembers your team's work after the people who taught it have left, who is responsible for what it still believes? Tell us in the comments.

Sources: Xinhua · Zhidx · Anthropic — Introducing Claude Tag · arXiv — Revoked but Still Authoritative · Pandaily on Tencent WorkBuddy · Tencent Cloud