Lessons from Building Copilot Cowork

Copilot Cowork is an agentic execution layer for multi-step tasks, built to bring AI-assisted work to knowledge workers while retaining Microsoft 365 security, governance, and access to multiple models. Nine engineers took it from an empty repository to worldwide general availability in about four and a half months, with agents writing most of the code. By October 21, the team merged 1,211 pull requests in one day. Engineers remained accountable for specifications, architecture, security boundaries, and decisions about risky changes; agents proposed and reviewed code, but did not control what operations were allowed.

The team’s practices evolved as agents improved: write a markdown spec before coding; give parallel agents narrow tasks and choose models according to quality and cost; isolate models from credentials and route operations through a trusted host; and require automated checks to prove they actually tested something. Reviewer bots provide rapid feedback, but critical changes still receive human review. The team also records lessons in repository instructions, redesigns files to reduce merge conflicts, and enforces strict boundaries between Rust components so parallel work does not bottleneck on shared code. The account culminates in a live migration of the runtime from Python to Rust, made possible in part by the separation between the agent and its host.