Summary
Capability is getting cheaper. Authority is not.
An engineering agent can read a page, draft a change, interpret evidence, and operate software. None of those abilities answers the question that matters to an operating system: under whose authority may it act, against which state, with what evidence, and how will someone repair the result?
Our answer is intentionally unremarkable. Agents use the same permissioned state, actions, approvals, idempotency, and audit contracts as humans and jobs. They do not receive a privileged route to providers or domain state. A capable agent can inspect evidence, propose an action, or run a bounded local QA session. It still needs authority appropriate to the effect and a durable record of what happened.
That constraint makes agents less theatrical and more useful.
Operational Tension
Agents are most attractive where the workflow is least tidy: document triage, research, recommendation, repair assistance, and UI verification. Direct access looks efficient because it collapses observation, interpretation, authority, and action into one step. It also moves the least deterministic participant outside the controls that make the rest of the platform supportable.
A model-assisted interpretation can be useful evidence without being authority to change operational state. A browser task may need a rendered page without being entitled to a developer's signed-in session or an unowned local service. In both cases the danger is larger than an incorrect answer. The shortcut reassigns control without saying so.
The real boundary is therefore not human versus agent. It is evidence versus authority, and proposed action versus accountable effect.
Decision: Capability Without Privilege
Agents participate in existing workflow contracts. They observe the state their role permits, propose actions through domain services, request approval where the effect requires it, carry idempotency keys, and leave an audit trail. Domain services still own state transitions. Integrations still own provider transport and credentials.
The same rule applies to model output. OCR or an LLM can produce structured claims that are parsed, validated, reviewed, and accepted as evidence. Those claims do not silently become a business commitment, a human-authored message, or a hidden provider mutation. Prompt and model details use the approved LLM audit path; generic logs keep redacted metadata or stable references.
Local tooling is not exempt. The agent-owned browser QA session is loopback-only, uses deterministic scenarios, records its process lifecycle, and leaves developer-owned ports and signed-in browser state alone. Ambient access is not permission. We create a bounded capability and make its ownership explicit.
Failure And Repair Posture
Uncertainty stays visible. If structured output fails parsing or business validation, the workflow records the validation outcome, issue, or repair signal instead of manufacturing confidence. A denied action is an authorization result, not an invitation to search for another route. A deterministic QA scenario proves only the behavior it exercised; broader integration needs its own scoped, non-production check.
Corrections then improve the system without creating retrospective mystery. A reclassified document, rejected recommendation, or unsuccessful proposal can inform a validator, prompt, interface, or policy. It does not need a free-floating "agent memory" outside the domain's history. Business meaning stays with durable business state.
Hard failures remain hard. Programmer mistakes, invariant violations, and unsafe authorization conditions must be visible. Turning them into friendly review cards would make a missing control look like a pending human decision.
Tradeoff
Shared controls add friction. A one-off assistant looks faster when it can call a provider, write a table, or borrow a running environment directly. The governed path needs service APIs, explicit actions, approval state, audit records, bounded retry, and repair affordances. It also reveals workflows that have never named their own action contract.
That friction buys substitutability and trust. A human, job, or different model can use the same interface. Operators can understand an effect without reading a private transcript. Security review has one boundary to examine. Automation can expand without making accountability depend on which participant happened to perform the work.
Limits
This proves that agent capability can enter an operational platform without a parallel control system. It does not make agent reasoning correct, eliminate human review, or create a universal permission model. Some work remains advisory, some needs a person with explicit authority, and some should not be automated. A local deterministic QA lane proves rendered behavior for its scenarios, not production authentication or provider behavior. This is not a claim about autonomous operation.
Transferable Lesson
Do not make an agent exception to introduce an agent capability. Give it the evidence, permission, approval, idempotency, audit, and repair paths that make the underlying work trustworthy. The result is easier to operate, replace, and improve—and it leaves human attention for judgment and accountability rather than cleanup after an opaque shortcut.