Most software carries a hidden assumption in its bones: the thing calling it is a human. Nobody writes it down. It just lives in the session model, the redirect flows, the helpful little tooltips. For thirty years, that assumption held. It is now quietly breaking. A growing share of the traffic hitting your endpoints comes from AI agents acting on someone's behalf, and they read your product nothing like a person does.
An agent does not scan a page or hesitate over a button. It parses whatever structure you expose, obeys the permissions you grant, and repeats the call with a precision no user can match. That precision is exactly what trips up systems tuned for "human forgiveness".
The stateless trap
Start with the humblest assumption of all: the session. Log in, do a thing, log out, context gone. A person shrugs and signs back in. An agent running a task across three days and eight services cannot. When a state lives only inside a session token, you have all but guaranteed that any long-horizon agent will fail somewhere in the middle, and the stack trace will point everywhere except the real cause. This is the first wall most teams hit when they get serious about designing for AI agents. Context has to graduate from a session property into real infrastructure: durable, portable across channels, and legible to both the human and the software acting for them.
Why outcomes should replace navigation
Human interfaces exist to guide. Menus, wizards, breadcrumbs, all of it is there to walk a person toward the right action. An agent wants none of it. It arrives with intent and wants a contract it can call. The more of your product that can take a high-level instruction and return a deterministic result, the better it serves an agent. The more it demands a march through manual steps, the more friction you have quietly baked in. In practice, that means fewer clever flows and more clean, idempotent endpoints whose responses need no interpretation.
How do you enforce agent permissions safely?
Here, casualness turns dangerous. A human can sense when something is off and stop. An agent, boxed inside the scopes you handed it, cannot. So the boundaries cannot be advisory. An agent cleared to book a meeting must be technically incapable of cancelling a contract, not merely discouraged from trying. Serious designing for AI agents treats this as architecture: scopes enforced at the system level, every action logged with the reasoning behind it, and an obvious path to reverse an outcome. Exercise those limits under realistic load before anything ships, because a permission you never tested is a permission you never actually had.
None of this throws out good design. It extends it. The teams that come out as winners in this perspective will not be the ones wiring up agents fastest, but the ones who built for delegation on purpose, well before a live system turned the mistakes expensive to unwind.
Top comments (0)