Virtual Employees

Employee-shaped identity

Pedro Franceschi's frame for corporate AI at Brex is to deploy agents that look, feel, and act like actual employees, real names on Slack, real email addresses, joining meetings and engaging colleagues directly, rather than treating them as features, chatbots, or background workflows.¹ The canonical instance is Jim, a recruiting agent built on OpenClaw: Jim is a Slack presence with his own email address who converses with the recruiting team as a colleague would, using the company's existing social fabric rather than requiring anyone to learn a new tool.

Self-bootstrapping

The build constraint Franceschi set was that Jim had to be built without a single line of code written by hand, and the resulting payoff is what he calls the most interesting property of this generation of models: a recruiter once asked Jim to check whether a resume looked fabricated, and Jim built itself a resume-fraud screening capability that nobody had ever explicitly coded. A virtual employee, on this account, accretes new skills from its coworkers' requests the same way a capable human hire gradually does, rather than shipping with a fixed feature list.¹

Employee-shaped oversight

The oversight model deliberately reuses ordinary employee machinery rather than inventing something new: Jim has a manager, a real person on the recruiting team who signs off on Jim's actions, gives feedback and checks that it gets incorporated, grants tool access, sets a budget, and can effectively fire Jim if something goes wrong. Franceschi generalizes the underlying logic with a comparison to a certified public accountant: a CPA's personal legal liability for a tax filing is the back-pressure that keeps an entire professional toolchain honest, and he expects agent-run professional services to keep a human at the end of the chain for exactly the same reason.¹

The security posture that enables it

The default industry posture toward capable but unpredictable models has been to avoid deploying them anywhere important. Brex's approach inverts that: treat agent security as a distributed-systems engineering problem to be solved rather than a reason to wait, then deploy. The specific mechanism, a proxy called CrabTrap, records a day of an agent's traffic and then routes all of its outbound actions through a second model that checks whether a given action is something that agent should plausibly be doing, auto-approving roughly 98 percent of actions and blocking violations at the network layer without the first agent even being aware of the check.² The underlying belief is that the only technology actually capable of monitoring an agent at scale is another agent, not a human reviewing every action by hand, which produces an adversarial, agent-watches-agent architecture. Virtual employees are, by design, currently deployed in a handful of functions and deliberately not yet in the most critical workflows.

Why it matters

This resolves a real dilemma many companies face between waiting for frontier models to become provably safe and deploying them anyway: instead of waiting, wrap the model in a monitoring layer the company itself controls. Self-bootstrapping also changes the economics of internal tooling, since new capability appears out of ordinary conversation rather than requiring a dedicated engineering sprint, and the effective backlog becomes whatever coworkers happen to ask for. It is also worth noting that a closely related pattern shows up independently from the other side of enterprise software: Alex Bouaziz has separately described managing AI agents through the same payroll and human-resources systems a company already uses for its human employees, arriving at essentially the same conclusion, that the org chart rather than a technical API layer is where agent accountability actually needs to live, from the opposite end of the problem.