AI Enablement Radar week 27: make AI work visible before you scale

This week, AI enablement looks less like "try a new model" and more like ordinary work: Microsoft is packaging Copilot for small businesses, Anthropic released both Sonnet 5 and a science workbench, Notion is putting external agents on shared boards, Google is baking evals and human checkpoints into the agent stack, and GitHub is making Copilot usage easier to measure. For Hammer readers, the useful move is simple: choose one workflow, give AI the right sources, and make the work visible before you scale.

Top signals this week

• Microsoft makes Copilot more concrete for small businesses. Microsoft 365 Business Standard with Copilot and Business Premium with Copilot are now generally available. Microsoft makes the point many smaller teams recognize: AI should sit inside Word, Excel, PowerPoint and Outlook, not create another detached workspace.

Source: Microsoft 365 Blog, Introducing Microsoft 365 Business with Copilot

• Copilot Cowork shows how long agent work can get. Microsoft says more than half of the Fortune 500 used Copilot Cowork during preview, alongside companies such as Accenture, Avanade, Capital Group, Koch, Ooredoo Qatar and Zurich Insurance. The examples are batch jobs, file comparisons, pipeline reviews and long multi-tool tasks.

Source: Microsoft 365 Blog, Copilot Cowork is now generally available

• Sonnet-class models are becoming more practical for agent work. Anthropic released Claude Sonnet 5 as the default model for Free and Pro, also available in Claude Code and the API. The useful signal is not a benchmark on its own. It is that a lower-cost Sonnet model is now aimed at planning, tool use, coding and professional work.

Source: Anthropic, Introducing Claude Sonnet 5

• Notion is making agent work visible on a shared surface. Notion 3.6 lets teams orchestrate external agents such as Claude and Cursor from Notion, give agents Excel, PowerPoint, Word and PDF context, connect Outlook, and track Custom Agent activity in the Enterprise audit log.

Source: Notion, Notion 3.6: External Agents, HTML blocks, and more

• Measurement is becoming its own layer. GitHub improved Copilot usage metrics so Copilot CLI lines, IDE data and AI credits are captured more completely. Google also showed an eval flywheel where agent changes are tested against traces, AutoRaters and before/after baselines instead of gut feel.

Sources: GitHub Changelog on Copilot metrics and Google Developers Blog on the Agent Quality Flywheel

What organizations are actually doing with AI

Microsoft’s small-business launch is the most grounded adoption example this week. Copilot is built into Microsoft 365 Business plans, connects to Word, Excel, PowerPoint and Outlook, and can use more than 1,000 connectors to apps such as Shopify, PayPal, Xero, Docusign, Asana and Canva. Smaller organizations need the same pattern in a lighter form: what sources may AI read, what may it do, and how do we know the result held up?

Source: Microsoft 365 Blog, Introducing Microsoft 365 Business with Copilot

Copilot Cowork shows how larger organizations are testing longer agent jobs. Microsoft describes one team that taught Cowork to edit batch-job spreadsheets and generate dependency flow charts after every change, another that compared nearly 4,000 files across two product versions, and a sales lead who got a ranked list of at-risk opportunities. For a small Nordic team, the lesson is not to copy the Fortune 500. The lesson is that long AI work needs a task, sources, a cost boundary and a visible handoff back to a person.

Source: Microsoft 365 Blog, Copilot Cowork is now generally available

Anthropic shows the same pattern in research with Claude Science. The app brings literature, code, models, cluster jobs and review into one workbench. Manifold Bio is cited for target nomination in tissue-targeted medicines, the Allen Institute for a multi-agent review template, and UCSF for molecular epidemiology where analysis reportedly ran in roughly one-tenth of the previous time. The transferable lesson is not biology. It is the operating model: sources, runnable code, a reviewer agent and reproducible artifacts in one flow.

Source: Anthropic, Claude Science, an AI workbench for scientists

The tooling layer: platforms, agents, and workflows

MCP, Model Context Protocol, is a way for AI assistants to use approved external tools and data sources through a more standard interface. Notion says Notion MCP usage grew 10x in the past month and adds five ready-made Custom Agent connections: Mercury, Mixpanel, Miro, Box and ClickHouse. When these connections become normal, the question is no longer "can AI read more?" It is "which connections belong in our workspace, and who can see what the agent did?"

Source: Notion, Notion 3.6: External Agents, HTML blocks, and more

Google is moving in the same direction from the developer side. ADK for Go 2.0 turns agent flows into graphs with routing, fan-out/fan-in, loops, state, human pauses and restart across process boundaries. That sounds technical, but the pattern is useful even without Go: a good AI workflow should be able to pause, ask a human, resume later and show which steps ran.

Source: Google Developers Blog, ADK for Go 2.0

Genkit Agents handles the other half: conversation state, tool loops, streaming, snapshots and a client/server protocol for agentic apps. For small teams building internal tools, the signal is clear. Stop building "a chatbot next to the work". Build a workspace where the agent has status, history, artifacts and a clear abort button.

Source: Google Developers Blog, Build agentic full-stack apps with Genkit

GitHub also removed a practical blocker: Copilot CLI can now run in GitHub Actions with the built-in GITHUB_TOKEN instead of a personal access token. The workflow needs copilot-requests: write, and cost can be monitored through organization billing, usage dashboards, cost centers and session limits. That is exactly the kind of integration-first security that makes automation useful without spreading long-lived secrets.

Source: GitHub Changelog, Copilot CLI no longer needs a personal access token in GitHub Actions

Governance and risk: what needs to be in place before scaling

AI governance does not have to start as a heavy policy document. For a smaller organization, it often starts with four things: approved sources, bounded permissions, human checkpoints for irreversible actions and a simple log of what the agent read, assumed and proposed.

The EU AI Act makes this more concrete for the coming years. The page describes risk levels, prohibitions, transparency duties and high-risk obligations such as risk management, documentation, logging, information to users, human oversight, robustness, cybersecurity and accuracy. GPAI, general-purpose AI, model rules apply from August 2025, and the EU Code of Practice is intended as a voluntary tool for providers to meet transparency, copyright and safety obligations.

Sources: European Commission, AI Act and European Commission, General-Purpose AI Code of Practice

Zapier puts words to a more everyday governance problem: do not measure AI adoption as token volume. The "tokenmaxxing" article has a playful tone, but the point is serious. If the metric is how much AI someone consumes, people and agents will consume more. Measure time saved in a concrete workflow, fewer errors, better response time or more finished cases instead.

Source: Zapier, The perils of tokenmaxxing

Zapier describes the same control work from the integration side: map tools, triggers, inputs, decisions, actions and human checkpoints before an agent gets more access. It is a useful checklist even if you do not use Zapier.

Source: Zapier, How to conduct an AI agent security audit

An eval is a repeatable test case that shows whether an AI workflow improved or degraded after a change. Google describes a flywheel that builds datasets from OpenTelemetry traces, hand-written cases or synthetic scenarios, runs the agent, lets AutoRaters grade traces and compares against the previous baseline. Hammer readers can use a lighter version: save five real examples, make the change, run them again and compare with the same review questions.

Source: Google Developers Blog, Driving the Agent Quality Flywheel from Your Coding Agent

This week's practical Hammer test

Test an agent workflow as a work order, not as a chat. It takes 30 to 45 minutes.

1. Pick one focused workflow: customer email to follow-up list, meeting note to action card, support question to draft answer, or proposal material to risk list.
2. Write a work order with the goal, approved sources, data the AI may use, tools it may touch and decisions that need human approval.
3. Run three old examples through the flow. Ask AI for a receipt: sources read, assumptions, proposed actions, uncertainties and the next human decision.
4. Measure the result with two simple questions: did this save real time, and did anything important turn out wrong or unsourced?
5. If the flow needs integrations, use environment variables or a secret manager for keys, scoped API permissions, sensitive-field redaction, approval gates and an audit log. Do not put passwords in the prompt.

You can copy this prompt:

You are our AI work lead for a bounded test. Read only the sources I provide. Create a work card with the goal, approved sources, proposed steps, decisions that require human approval, risks and a short run receipt. If you suggest integrations, first list the permissions, secrets, redaction, approval gates and audit log required.

This is a typical Tool Forge case: not more AI tabs, but a workflow the team can run, measure and improve.

Companies and tools to watch

• Microsoft 365 Business with Copilot: shows AI being packaged directly inside the work tools small businesses already use.
• Notion External Agents: makes agent work visible where teams already plan and follow up on tasks.
• Google ADK, Genkit and Agent Quality Flywheel: point toward agent flows that are pausable, measurable and built for real apps.
• GitHub Copilot usage metrics and Copilot CLI: make actual use easier to measure and AI easier to run in CI without long-lived PAT secrets.
• EU AI Act and GPAI Code of Practice: turn documentation, logging and human oversight into practical procurement questions, not just legal ones.

If you want to make this real next week, Hammer can help through Tool Forge: we choose one workflow, connect the right sources and tools, set approval gates and build a simple receipt so the team sees what AI actually did before anything moves forward.