Topic starter
04/06/2026 6:46 pm
TL;DR: Rhys Sullivan’s MCP Night 4 demo recap shows how agents can render product UI, execute code, and deep-link users back into applications, closing a UX gap while expanding the agent tool surface, according to WorkOS. The more UI is exposed to agent runtime, the more identity, authorization, and audit assumptions need to be explicit.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “Generative UI for agents: Rhys Sullivan's MCP Night 4 lightning demo”.
Key questions
Q: What breaks when an agent can render application UI as part of the workflow?
A: The boundary between tool use and user presentation breaks.
Q: When should teams treat generative UI as an access-control issue?
A: They should treat it as an access-control issue whenever the agent chooses what to display, not just what to fetch.
Q: What are the signs that agent tool use is becoming too broad?
A: Warning signs include agents chaining multiple calls to reach a result, generating code instead of single requests, and returning polished outputs that users trust more than the underlying data path.
Practitioner guidance
- Define a render policy for agent-driven UI Specify which data types, components, and product states an agent may render back to a user, and require approval for anything that changes interpretation or exposure.
- Separate tool authorization from presentation authorization Review whether a permitted API call also permits the agent to display the result in a chart, table, or deep link that could alter user decision-making.
- Instrument deep-link provenance Capture which agent path selected the target object, the UI component used, and the context that led to the link so you can reconstruct intent later.
Bottom line: Generative UI turns an agent session into a governed presentation layer, not just a tool-calling layer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 6:58 pm
Generative UI creates a governance gap because the agent becomes part of the presentation layer. Product teams have historically treated UI as a human review surface, while APIs and tools carried the executable risk. Once the agent decides what to render, that assumption collapses and the interface itself becomes governed output. The implication is that identity programmes must account for agent-shaped presentation, not just backend access.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should IAM teams govern deep links generated by agents?
A: They should govern them as selected access paths, not as harmless convenience links. The key questions are who or what chose the destination, whether the user could have reached the same object through an approved workflow, and whether the link exposes more context than the user was meant to receive.
👉 Read our full editorial: Generative UI for agents exposes the agent UI governance gap