Topic starter
06/06/2026 2:27 am
TL;DR: The open web was built for humans, not machines, and AI agents now need to click, scroll, extract, and act across it to complete work, according to WorkOS. The shift makes agent-ready access, protocol design, and governance assumptions central to identity security rather than a niche integration concern.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “Homer Wang on building TinyFish and the future of AI agents”.
Key questions
Q: What breaks when AI agents have to rely on human-only web interfaces?
A: Human-only interfaces force agents to infer intent from visual layouts, browser state and multi-step interaction patterns that were designed for people.
Q: Why does machine-readable access matter for agent governance?
A: Machine-readable access makes it possible to distinguish between authentication, task scope and permitted actions.
Q: How should security teams govern AI-assisted web testing tools?
A: Treat AI-assisted testing as a governed workflow, not a convenience feature.
Practitioner guidance
- Map human-only journeys Identify business-critical web workflows that still depend on clicks, scrolling or visual interpretation, then classify which ones block agent execution and where machine-readable interfaces are needed.
- Separate login from task permission Define what an agent may authenticate to and what it may actually do once inside, so delegated access does not collapse into broad user-equivalent privilege.
- Review browser automation controls Treat screen-scraping and browser-driving agents as governed execution paths, with logging, approval boundaries and scope limits tied to the business task rather than the browser session.
Bottom line: The article shows that AI agents are increasingly forced to operate through web experiences designed for humans, which exposes a governance gap between login and usable action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 4:08 am
Human-centric web design is now an identity governance constraint. The article shows that many digital services still assume a human operator is the thing making sense of the interface. That assumption worked when software was downstream of human decision-making, but it becomes brittle when AI agents need to complete the task themselves. Practitioners should treat human-only UX as a governance dependency, not just a product limitation.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between agent-ready web design and browser automation?
A: Agent-ready web design exposes structured, machine-consumable interactions so software can complete work directly. Browser automation instead drives a human interface and depends on page layout, state changes and visual assumptions. The first is a control and integration strategy. The second is an operational workaround that usually carries more fragility and governance overhead.
👉 Read our full editorial: AI agents need the web to be machine-readable, not human-only