Dispatches from the
agentic frontier
News, analysis, and insights from the world of agentic experience design. Stay ahead of the shift from tools to trusted collaborators.
Featured
The agent-readable seriesMD Files Explained: The Complete Markdown Guide
Markdown is twenty-two years old and has quietly become the most important document format in your stack. What a .md file is, how to open one, the syntax that works everywhere — and why agents read it before they touch your codebase.
Markdown for AI: Why .md Files Became the Context Layer
Coding agents read AGENTS.md. Claude Code reads CLAUDE.md. Skills ship as SKILL.md. Since February 2026 Cloudflare hands an agent Markdown instead of your webpage if it asks. Why they all keep choosing a format from 2004.
Read the analysisNo dispatches in this category yet.
Eight Names for One Shift, and Which Ones Hold Up
Agentic software development. Agent-driven. Agent-first. Agent-native. Agent-assisted. Spec-driven. Intent-driven. AI-native. Eight names in circulation for the same broad thing, used interchangeably in the same paragraph and usually presented as a settled hierarchy. They are not one. Checking where each definition actually comes from turns up a pattern worth knowing before the vocabulary reaches a strategy document: three of the eight have a source with nothing to sell — Forrester, IBM, a peer-reviewed paper — and five were named by a party selling the thing the name describes. Includes the correction most taxonomies get wrong (Microsoft’s VS Code documentation calls agent-first development a synonym for agentic programming, not a distinct tier of autonomy), a five-level ladder sorted by who holds the loop, and the bottleneck none of the eight vocabularies has a word for: agents produce faster than people verify, and the review queue does not multiply with the autonomy.
In Your Product, the Agent Should Be the Guest
We shipped WebMCP tools on our own homepage in the spring, registered them on the API name Chrome had already moved away from, and they did nothing for weeks — failing silently, exactly as designed. That is the whole subject in miniature. Ecommerce got its agent tool surface as a platform default in a single week: Shopify on 5 August, Cloudflare the day after. Nobody will do that for your SaaS product, which is the point. With an MCP server your interface renders inside the agent; with WebMCP the agent is a guest on your platform. Which of those you pick decides whether your product is still an interface or just a database with an invoice attached. Three tiers of software category, session inheritance as both feature and exposure, why prompt injection is worse in a console full of support tickets than on a storefront, and the mid-chain failure that completes the job while skipping a step and telling nobody.
The Agent Supervision Register: 12 Enterprise Platforms Scored
Every vendor can tell you what their AI agent is capable of. Far fewer can tell you what the person whose work it changed will see afterwards. Twelve enterprise platforms scored on two axes that are never combined — capability, and whether the accountable human can see, approve and reverse what the agent did. Median capability: 11 of 12. Median supervision: 6. Microsoft scores 12 and 4. Not one of the eleven scored platforms documents a way to reverse the work an agent performed. 132 cells, every one traced to a vendor page and dated, published with its own five corrections visible rather than quietly fixed.
How We Score Agent Supervision: Method, Criteria and Limits
The rubric behind the register, published separately so it can be checked, argued with and applied to platforms we did not assess. Two axes, twelve criteria, scored 0–2 against public vendor documentation only. Two rules do most of the work: a recommendation is not a control — guidance published to developers is not a thing the platform does — and a receipt has an audience, because a run log only the agent's owner can read is a different product from one the affected person can read. Plus the evidence standard, the withdrawal rule, and six limitations we would rather publish than have found.
AI Layers Name Index: What 12 Enterprise Platforms Call Their AI
Notion has one. Salesforce has one. So do ClickUp, monday.com, Microsoft, Google, Adobe, ServiceNow, HubSpot, Atlassian, Slack and Klaviyo — and most of them ship three or four separately named AI products under a single umbrella brand, with different pricing, different permission models and different failure modes. A dated index of thirty-six named products across twelve platforms, sorted into assistants, agents, builders and control planes. Four documented renames — and two new tiers that almost every published roundup reports as renames when the earlier product is still shipping underneath. Maintained at one URL, with every entry carrying the date it was last checked.
AGENTS.md for Teams That Don't Write Code
AGENTS.md is in over 60,000 repositories and read natively by more than twenty agent tools — and every guide to it is written for engineers. Strip the format to its structure and nothing in it is code-specific: where the material lives, how work is done, what must pass, what must not be touched. Two complete worked examples for a marketing workspace and a revenue-ops workspace, a generator that runs in your browser, where the file goes when your team doesn't have a repository, and why the ETH Zurich evidence says a short file beats a complete one.
brand.md: Brand Guidelines Agents Can Actually Read
Your brand book is a beautiful 90-page PDF, and by September four different AI systems are each producing brand voice from a different hand-cut excerpt of it. Nobody has done anything wrong; the source of truth was built for a format only humans open. The brand.md pattern: the operating subset of a brand system in a form machines can apply without interpretation, the eight sections that belong in it, a template with no email gate, and the ten-prompt test that tells you whether it is doing anything at all.
Prompt Injection in .md Context Files
Every other input an agent receives is treated with some suspicion. Context files are the one category it is built to trust and follow — which means the published injection defences, all of which rest on separating instructions from retrieved content, do not apply. There is no boundary to enforce and no anomaly to detect. The attack surface, four scenarios that need no attacker and no compromise, what the crawl data shows about who is already surveying these files, and the six organisational controls that actually hold.
llms.txt: What 137,000 Sites' Server Logs Actually Show
An entire optimisation practice grew up around a single text file — scoring tools, validators, vendor packages, conference talks — before anyone checked whether its intended readers had arrived. Then somebody read the logs: 97% of llms.txt files got zero requests in May 2026, AI retrieval bots account for 1.1% of the traffic to the ones that were read, and the largest single consumer is the SEO audit industry checking whether you have one. What the evidence supports, what Google says in writing, and the one narrow case where the file earns its place.
Private AI, Installed Inside Your Organisation
Some organisations have quietly opted out of AI entirely — not for lack of interest, but because the material is confidential and sending it somewhere else isn't a conversation they want to have. The blocker is almost never interest; it is where the documents go. Why "private" and "offline" are not the same thing, the middle option most firms actually want, what a private system consists of, an interactive six-question fit check — and an honest list of who we would talk out of it.
Recommended by AI, Impossible to Buy From
Being the answer and being the purchase are two different capabilities. Between 2025 and 2026, Google, OpenAI, Stripe, Meta, Visa, Cloudflare and Coinbase each published a piece of the same missing infrastructure. Eight layers decide whether an agent can find your product, verify it, trust you and buy it — and the failure is silent: you are not outranked, you are dropped from the comparison with no impression data to explain it.
MD Files Explained: The Complete Markdown Guide
Markdown is twenty-two years old and has quietly become the most important document format in your stack. What a .md file actually is, how to open one on any system, the complete syntax, the flavours that break it, how to convert to and from anything with Pandoc — and the agent files (AGENTS.md, CLAUDE.md, SKILL.md, llms.txt) that made a 2004 format into infrastructure.
Markdown for AI: Why .md Files Became the Context Layer for Agents
Coding agents read AGENTS.md. Claude Code reads CLAUDE.md. Skills are packaged around SKILL.md. Websites publish llms.txt. Since February 2026 Cloudflare will hand an agent Markdown instead of your webpage if it asks — an 80% token reduction on its own announcement post. Why every one of these systems keeps choosing a syntax designed in 2004, and what that means for your business context.
The Developer's Rosetta Stone: AI & Agentic Platform Comparison
When you switch AI platforms, the model is the easy part. The friction is vocabulary — the same capability wearing a different name in every stack. A tool here is a function there, a skill in a third and a connector in a fourth; the memory you configured in one console is a knowledge base in the next. A cross-platform translation map for developers and architects moving between enterprise agent platforms, agentic IDEs, data-native builders, and skills architectures.
The Chasm Runs Through Your Org Chart — Our New Field Guide Maps the Crossing
Enterprise agent pilots don't fail on capability — they fall into the chasm between the visionary sponsors who bought the demo and the pragmatists who run the work. Our new free field guide applies Geoffrey Moore's 1991 chasm to the inside of your organization: what pragmatists actually buy (references, the whole product, accountability), the five layers as that whole product, and six signs you're across. Read it alongside the five-step playbook.
What Is Agent Operability — and Why Your Enterprise Needs It
auxfirst introduces agent operability: the capacity of a specific workflow to be performed by an AI agent with bounded autonomy, usable context, explicit decision rights, and reconstructable accountability. Why pilots keep dying in security review (the death spiral in seven steps), the three-layer model — data shape, process design, trust & permissions — a five-question self-check you can run today, plus the free field guide at agentoperability.com and the fixed-price Agent Operability Audit.
Execution Got Cheap. Trust Didn't.
Three June-2026 studies and two same-day design publications point at one structural change: cheap execution relocates the human — from doing to directing, and from trusting output to verifying provenance. The delegation economics (26 minutes of autonomous work vs 33 seconds of search), the expertise multiplier (humans keep ~70% of planning decisions), why complexity sliders fail (46% compliance), and the four design imperatives mapped onto the AUX components that answer them. With a 60-second verification test for teams shipping agents.
AI Models Have Formed Beliefs About Your Brand. We Built the Instrument That Reads Them.
Launching the Agentic Shelf Audit: a fixed-price, ten-day audit of everything AI models assert about a brand — every belief graded (accurate to fabricated), traced to its sources, and turned into an influence roadmap. With findings from a composite sample battery — 52 queries, four models, 418 transcripts: a Belief Integrity Score of 58/100, a false allergen claim delivered as safety advice, and a study that doesn't exist. Starts with a free 3-belief teaser.
The 40th Principle: Who Verifies the Other 39?
Taras Bakusevych's "39 Principles for Designing Human–AI Interaction" is the best applied synthesis of the field to date — model specs as design canon, sycophancy as a design problem, provenance over confidence. But every principle assumes a human on the other side of the glass, and that assumption is expiring. Two blind spots — the agent as the user, and principles without proof — with a mirror table, the EU AI Act mapping, and the 40th principle the field needs: make conformance verifiable.
AI @ Santander: The Good, the Bad, and the Ugly
A bank open-sourced its AI lab — fourteen Apache-2.0 repositories, none mentioning agentic experience design, which makes them an honest X-ray of how a regulated institution thinks about trusting machines. Read through an AUX lens: the good (mechanical governance, provenance, bounded mutation), the bad (almost no dry-run, a client that omits a confidence signal), and the ugly (an agent-runner that ships every guardrail off by default). With a scorecard and the lesson underneath: you learn a team's trust model from its defaults, not its framework.
Process Brains: Why You Need Them and How to Build Them
Most teams use AI; far fewer have turned it into anything that compounds. A process brain is a small, governed machine that captures how one job should be done and does it the same way, every time. The four parts of a brain, why prompting doesn't compound, and how to choose between a lightweight, heavy-duty, or multibrain system — with a comparison table and the order to build them in.
The Agents Got Jobs — What YC's Spring 2026 Batch Reveals
Go down YC's Spring 2026 list — just under 200 companies — and the overwhelming majority aren't building assistants that talk; they're building agents that act. The unit of value moved from seats to outcomes, and the design problem from screens to consequences: identity, permission, spend, evidence, escalation, liability. A field note that maps the batch onto the agentic-design questions — with a comparison of who's solving what.
Open-vs-Closed Is a Procurement Question, Not a Trust Question
US labs vs Chinese labs, open weights vs closed APIs — the loudest argument in AI is a scoreboard, and for anyone shipping agents it's the wrong one. The model is the most swappable part of the stack. The durable questions: which model for which task, inside which guardrails, with what proof. With a model-lineup comparison and the "narrowed, not closed" benchmark.
Eve Makes Agents Legible. It Doesn't Make Them Accountable.
Vercel's Eve makes an agent a directory of files and ships the production machinery — durable runs, sandbox, approvals, traces, evals. It makes agents legible; it doesn't make them accountable. That evidence-to-attestation gap, across a separating five-layer stack, is exactly where AUX lives. The companion to the Vercel reclassification.
The Agent Buyer's Map
A new procurement category — AI agents — with no Magic Quadrant and no shared buyer vocabulary, so every vendor ships an evaluation framework built to flatter its own agent. The independent, buyer-side answer: ten dimensions, one number, one vocabulary across every vendor. Score it live on the page; print the one-pager.
Can I Prove What the Agent Did?
Jamin Ball says the clearinghouse wins the agent era — and Microsoft is already shipping it. But for a brand, "prove what the agent did" fractures into four questions a permission log can't answer: who authored it, is it on-brand, is it brand-safe, and did a human genuinely sign off. The source of trust is a different layer.
Cites or Escalates — Designing a Compliance-Grade Policy Agent
Every certified company has the same gap: the policies exist, but nobody can use them. How to design an ISO 27001 policy agent under contract — closed world, a citation on every claim, escalation to a named human the moment the source goes silent. Nine files, eight brains, zero write access.
A Safe Agent Isn't a Trusted One
Agent trust is two problems, not one. Machine safety is standardizing in the open — table stakes within a year or two. Whether a human can understand, steer, recover, and rely on an agent over time is a separate discipline: Agentic User Experience, and the real moat.
Agent Enablement — The Operational Layer
Your agents aren't underperforming because the model is weak. They're underperforming because everything around them — context, tools, playbooks, feedback — was never built. The four pillars, a toolbox, and a maturity ladder.
The Two-Layer Stack: AUX Above Microsoft's Agent Governance Toolkit
Microsoft just shipped the deterministic enforcement layer for autonomous agents. AGT makes the agent incapable of misbehaving. AUX makes the user willing to keep using it. Both necessary. Neither sufficient. Here's how they stack.
Agent-First API Design — The New Developer Experience
For thirty years, API-first meant designing for human developers. In the agentic era, the primary consumer of your API is an autonomous system. Six principles, a CRM worked example, and a ten-point checklist for the new DX.
What Is Agentic User Experience (AUX)?
The AUX Start Pack — manifesto, six foundational patterns, eight principles, ten heuristics, a four-stage trust architecture, and TrustKit. Everything a team needs to design for agents, memory, and trust.
Advertising Agencies Are About to Hit the Agentic Trust Crisis
AI is moving from generation to delegation. Most agencies are not ready for the question that follows: can we trust this agent to act inside this workflow, for this client, without damaging the brand?
Launching Auxfirst on GitHub: Introducing TrustKit
We're launching Auxfirst on GitHub and introducing TrustKit — a foundational trust abstraction layer for AI agents, distributed systems, and verifiable communication between services.
10 Heuristics for Agentic Experience
A visual reference for the 10 core heuristics of AUX design — covering trust, autonomy, memory, transparency, and control. Download and use as a design checklist or team alignment tool.
Agentic User Experience
Understanding the next interface paradigm. Software is shifting from tools you operate to systems that act, agents that decide, and software that works for you. The unit of interaction is no longer a click — it's an intention.
AUX Examples: Structured Agent Flows
Eight real-world AUX examples covering sales, support, fitness, developer tools, GTM, finance, onboarding, and content — each demonstrating intent handshakes, progressive autonomy, and trust design.
Beyond Greedy Reasoning: An AUX Framework for Long-Horizon Agent Reliability
Step-by-step reasoning behaves like a greedy local policy. Long-horizon reliability needs explicit lookahead, backward value propagation, and limited commitment with replanning — solved experientially through AUX.
Designing Agentic User Experiences (AUX)
From desired outcomes to AX to spec and production system. A complete design methodology covering trust layers, six design primitives, interaction patterns, and three implementation approaches.
The Core Mismatch
One-agent multi-user chaos vs. what AUX assumes: a multi-actor, governed system. How AUX architecture solves the fundamental problems of role-agnosticism, memory leaks, and conflict resolution in current LLM setups.