Enforce agent access parity with other mediums

If a user can do something through a browser or mobile app, their delegated agent must be able to do the same thing — unless the sensitivity of the interaction explicitly requires direct human authorization.

Why

The canonical AX framework (agentexperience.ax — Agent Accessibility) states verbatim: "The quality ceiling of an agent experience is capped at the level of access parity provided to agents vs other mediums." Every feature, resource, or action that exists only in a browser UI and not in an API is a hard ceiling on what any agent can do for your users. As agents become primary interfaces — Biilmann documented Netlify crossing 10,000 agent-led deploys per day — this ceiling becomes your product's effective capability boundary.

The corollary is equally important: requiring a human where not absolutely necessary is an anti-pattern. The canonical framework is explicit: areas where human involvement is required must be limited to interactions where authorization must be verifiably permitted by the end user — and even then, the agent should be able to continue after that authorization is granted.

Do

Audit every user-facing capability against your API surface. For each capability, either expose it to agents or document why it requires direct human authorization. Build APIs with parity to your UI as a default design principle, not an afterthought.

Don't

Launch UI features with no API equivalent and call it "good enough." Don't require a human account creation before an agent can begin work (see AX-SYS-43). Don't gate read operations behind human auth when the data is not sensitive.

Artifact

Access parity audit checklist — for each user capability:

[ ] Exists as an API endpoint or MCP tool
[ ] If not: documented reason why human auth is required
[ ] If human auth required: agent can continue after auth (not re-blocked)
[ ] Rate limits and scopes are equivalent to browser/app access
[ ] Error responses are machine-readable (not just HTML error pages)