AI agents need the web to be machine-readable, not human-only

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WorkOS's blog post: The open web remains human-centric, so AI agents need machine-readable access patterns to complete real tasks.

Why it matters: IAM teams should treat agent access, delegation and protocol design as core governance issues because machines now need to navigate human-built web flows.

Context

The central problem is not web access in the abstract. It is that many websites, workflows and controls still assume a human will be present to click, scroll, interpret and confirm each step, which breaks down when an AI agent must complete the work end to end.

For IAM and access control teams, that shift changes the programme boundary. The issue is no longer just whether a service can authenticate, but whether machine-readable interaction patterns, delegated authority and environment-specific controls can support agent-driven work without collapsing governance assumptions.

Key questions

Q: What breaks when AI agents have to rely on human-only web interfaces?

A: Human-only interfaces force agents to infer intent from visual layouts, browser state and multi-step interaction patterns that were designed for people. That makes execution brittle, hard to govern and difficult to audit. The failure is not simply automation complexity. It is that the access model assumes a human interpreter exists, which does not hold when software is acting on its own.

Q: Why does machine-readable access matter for agent governance?

A: Machine-readable access makes it possible to distinguish between authentication, task scope and permitted actions. Without it, organisations end up granting browser-level access that is broader than the work actually requires. That increases review difficulty, weakens auditability and makes it harder to prove that an agent stayed within its intended delegation boundary.

Q: How should security teams govern AI-assisted web testing tools?

A: Treat AI-assisted testing as a governed workflow, not a convenience feature. Define which targets, data, and actions the tool may touch, assign separate credentials and logs, and require human approval for anything that could affect production systems. The goal is to keep the agent’s scope narrow enough that its actions remain attributable, reviewable, and reversible.

Q: What is the difference between agent-ready web design and browser automation?

A: Agent-ready web design exposes structured, machine-consumable interactions so software can complete work directly. Browser automation instead drives a human interface and depends on page layout, state changes and visual assumptions. The first is a control and integration strategy. The second is an operational workaround that usually carries more fragility and governance overhead.

Technical breakdown

Why human-only web flows break for AI agents

Human-oriented web design depends on visual cues, interactive state and sequential intent that a person can interpret in the browser. AI agents can imitate that behaviour, but only by combining page navigation, extraction and action into a workflow that bridges multiple states. That is why simple retrieval is not enough: the agent needs to observe, decide and continue through the flow without a human reading the page. When sites expose no machine-readable path, the agent is forced into brittle screen-driven automation that is harder to govern, test and secure.

Practical implication: treat agent access as an interaction-design and governance problem, not only a browser-automation problem.

Machine-readable access and protocol design for agent work

Machine-readable access means the system can present content, actions and permissions in ways software can consume directly instead of inferring them from a human interface. In practice, that can include structured endpoints, predictable data formats and task-scoped permissions that let an agent act without scraping the entire page. The article’s point is not that every site must be rebuilt, but that agent-ready architecture will increasingly need interfaces designed for programmatic interpretation. Without that, organisations will keep layering fragile automation on top of human UX.

Practical implication: inventory which user journeys still depend on visual-only interaction and identify where agent-facing interfaces are needed.

Delegated authority is becoming an access-control issue

Once an agent is acting on behalf of a user or service, the access model stops being about whether a person can log in and becomes about what the delegated actor is allowed to do at runtime. That introduces a governance gap between authentication and effective action: the agent may be authorised to reach a site, but not necessarily to perform every task the human could perform. This is where identity security intersects with task boundaries, consent, and auditability. The article highlights that the web itself is being used as a work surface for machines, which means access scope must be intelligible to both the system and the reviewer.

Practical implication: define explicit task boundaries for agent access and separate login permission from action permission.

NHI Mgmt Group analysis

Human-centric web design is now an identity governance constraint. The article shows that many digital services still assume a human operator is the thing making sense of the interface. That assumption worked when software was downstream of human decision-making, but it becomes brittle when AI agents need to complete the task themselves. Practitioners should treat human-only UX as a governance dependency, not just a product limitation.

Machine-readable access is becoming the real control plane for agent work. If a workflow can only be executed through visual interaction, organisations are implicitly relying on brittle browser automation rather than governed delegation. The important shift is not more automation for its own sake, but clearer separation between authentication, task scope and execution permission. In NIST-CSF terms, this is access authorisation and entitlement design becoming central to agent operations.

Agent-ready systems will force teams to re-evaluate where identity ends and application workflow begins. The open web is increasingly part of the execution environment for AI agents, which means identity teams cannot stop at login, federation or SSO boundaries. They need to understand which actions are being performed, by whom the agent is acting, and whether the underlying application exposes usable machine semantics. That is a programme design issue, not just a tooling issue.

Web automation for AI agents creates a new kind of trust debt. The more organisations depend on screen-driven workarounds, the more they accumulate hidden assumptions about reliability, attribution and control. TinyFish’s premise is a symptom of a larger category change: if the web remains human-only, agents will keep operating through proxies that are difficult to govern. Practitioners should prepare for access models that are explicit about machine intent and machine scope.

Agent identity will increasingly be judged by what it can do, not just what it can reach. That moves governance away from static permissions and toward task-constrained authorisation. The long-term question for identity teams is whether a delegated actor can be made sufficiently machine-readable that its actions are auditable, bounded and reviewable at scale. That is where identity architecture must evolve next.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Machine-readable access will become a governance requirement, not a convenience feature. As agents take on more work, the question changes from whether they can log in to whether the underlying service exposes task-scoped actions that software can consume and review. Organisations that keep relying on human-only web flows will push agents into brittle browser workarounds that are difficult to audit and even harder to constrain.

Access reviews do not solve interaction design gaps. A control can certify a permission set, but it cannot make a human-only website understandable to software. The programme implication is that identity teams need to work with application and platform owners on delegated action design, because the boundary between identity governance and product UX is now operationally real.

For practitioners

• Map human-only journeys Identify business-critical web workflows that still depend on clicks, scrolling or visual interpretation, then classify which ones block agent execution and where machine-readable interfaces are needed.
• Separate login from task permission Define what an agent may authenticate to and what it may actually do once inside, so delegated access does not collapse into broad user-equivalent privilege.
• Review browser automation controls Treat screen-scraping and browser-driving agents as governed execution paths, with logging, approval boundaries and scope limits tied to the business task rather than the browser session.
• Standardise agent-facing interfaces Prioritise structured endpoints and predictable data formats for high-value workflows that machines need to complete repeatedly, especially where human UI assumptions slow or break execution.

Key takeaways

• The article shows that AI agents are increasingly forced to operate through web experiences designed for humans, which exposes a governance gap between login and usable action.
• The core risk is not simply automation failure, but weakly defined delegation when browser-based work stands in for machine-readable access.
• Identity and access teams should treat agent-facing workflow design as part of authorisation, auditability and scope control rather than as a front-end convenience issue.

Key terms

• Agent-Ready Interface: An agent-ready interface is a tool surface that exposes structured commands, schemas, and machine-readable output so an AI system can operate it predictably. For governance, that means the interface itself becomes part of the control boundary and must be scoped like any other privileged access path.
• Delegated agent access: A pattern where an AI agent performs actions on behalf of a human user and should therefore inherit that user's permissions. The governance challenge is preventing the agent from becoming a privilege amplifier or bypassing user-scoped controls.
• Human-Only Web Flow: A website interaction pattern that assumes a person will interpret visual layout, click controls and make sense of page state. For machine actors, this creates brittle automation because the control model depends on human cognition rather than structured, programmatic semantics.
• Machine-Readable Access: An access pattern that exposes content and actions in a form software can consume reliably, such as structured data or predictable endpoints. For AI agents, it is the difference between governed delegation and fragile browser emulation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.