Your application has a second user now: an AI agent sharing the same session as the human. It can navigate, select, fill, and act, but it should not need a second interface — or a second permission model — to do it.

Many agentic applications solve this by generating new interfaces or by exposing application functions directly to a model. Both approaches discard something valuable: the semantics, accessibility, validation, permissions, and interaction patterns already encoded in the application.

This talk presents a different model. Chat becomes an intent surface, while results and human intervention remain in the application's existing UI. Controls declare what they do, when they are available, what state they change, and whether the decision belongs to the human or the agent. The agent operates through existing application handlers, while the application remains authoritative about permissions and state.

This becomes especially important during multi-step agent execution. A button offered to an agent five seconds ago may no longer be valid. A human may complete part of a workflow while the agent is waiting. Sensitive information can remain entirely inside the application's existing controls instead of traveling through the model context.

We will walk through these interaction patterns and the runtime evidence needed to distinguish “the agent said it worked” from “the application actually changed.”

The goal is a model-independent architecture in which the AI interprets intent and plans actions, while the application continues to own its UI, state, permissions, and truth.