# AX-SYS-43: Design agent-first onboarding — let agents start before humans create accounts

> Access and identity · intermediate · AX-SYS-43

Design onboarding flows where an agent can begin working on behalf of a user before the user has created an account. The human claims the work afterward. Forcing account creation before an agent can start is an AX anti-pattern.

## Why

The canonical AX framework (agentexperience.ax — Agent Accessibility) states that requiring human involvement where not absolutely necessary is an anti-pattern. Biilmann documents three companies that operationalized this at scale:

- **Netlify:** "deploy anonymously, then claim" — agent deploys to a URL, user claims the site with a single click, often creating their Netlify account in the process. Now powering tens of thousands of agent-led deploys per day.
- **Clerk:** updated their SDK to work without requiring signup so agents could install, setup, and preview Clerk without any human-in-the-loop interaction.
- **Prisma:** launched an API specifically for AI coding agents with a claim flow for newly created databases — agents spin up a full app with data access, user claims the database afterward.

The pattern is consistent: agent starts, human claims. This inverts the traditional onboarding funnel in a way that dramatically reduces friction for agent-mediated discovery.

## Do

Allow agents to create ephemeral resources (deployments, sandboxes, databases, instances) without requiring an authenticated user account. Generate a claim link or token the agent can surface to the user. Design a lightweight claim flow where the user takes ownership — and optionally creates their account — after seeing the agent's work.

## Don't

Require a human to sign up, log in, or complete account setup before an agent can take any action. Don't treat agent-initiated sessions as security risks by default — scope them appropriately (see AX-SYS-05) rather than blocking them.

## Artifact

Claim flow pattern:

```
1. Agent starts work (no account required)
   → Service issues ephemeral resource ID + signed claim URL
   → Agent surfaces claim URL to human: "Your project is live at https://xyz.netlify.app — claim it here: [URL]"

2. Human clicks claim link
   → Service authenticates human (OAuth, magic link, etc.)
   → Resource transfers to human's account
   → Agent session can continue under the now-authenticated context

3. Optional: agent continues with enriched access post-claim
```

Claim token schema:
```json
{
  "resource_id": "proj_xyz",
  "resource_url": "https://xyz.example.com",
  "claim_url": "https://example.com/claim?token=abc123&expires=2026-06-07T00:00:00Z",
  "expires_at": "2026-06-07T00:00:00Z",
  "scopes_post_claim": ["deploy", "config", "logs"]
}
```

## Citations

1. [Mathias Biilmann — AX in Practice](https://biilmann.blog/articles/ax-in-practice/) — Netlify pioneered the 'deploy anonymously, then claim' flow, powering tens of thousands of agent-led deploys per day. Clerk and Prisma implemented the same pattern — agents start working, humans claim the result.
2. [agentexperience.ax — Principles of AX](https://agentexperience.ax/concepts/principles-of-ax/) — Agent Accessibility: requiring a human to be involved in order to achieve a goal is an anti-pattern where not absolutely required
3. [Mathias Biilmann — One Year of AX](https://biilmann.blog/articles/one-year-of-ax/) — Access pillar: Must the human be in the loop? Forcing account creation before an agent can start is an AX anti-pattern

---
Source: Agent Experience Principles (axprinciples.com)