Most teams building an "agent" copy the same shape: a chat window, tool calls, and the user's OAuth token. The demo works. Then they add a delete, a spend, or a night job, and the product splits. Either the user drowns in approval modals, or the agent keeps a god token and the team cannot reconstruct what ran.
I hit that wall on nominee.dev. Coding-agent UX (plans, diffs, undo) fit Claude Code. A tool boundary needs allow, deny, or ask per call, a credential for that call, and a receipt. The model loop matched. The product contract did not.
"Agent" covers six products. They share a model loop. They split on interface, credential model, and failure mode. Pick the cell before you pick the prompt, the framework, or the model.
Two axes:
- surface: coding, background, or custom
- autonomy: human in the loop or autonomous
field guide no. 01
the agent surface map
authority moves right →
human in loop
person holds the wheel
autonomous
agent holds the wheel
coding
inside the codebase
human in the loop
the pair
you steer; it moves
examples
Claude Code · Cursor · Codex CLI
auth: your session · your credentials · approve protected actions
autonomous
the worker
issue in; branch out
examples
Cursor Cloud Agents · Devin · Jules · Copilot coding agent
auth: sandbox VM · scoped repo token · PR from agent identity
background
away from the foreground
human in the loop
the delegate
leaves; returns with proof
examples
ChatGPT deep research · Gemini Deep Research · Perplexity
auth: on behalf of you · bounded task · review before use
autonomous
the operator
runs while you sleep
examples
Replit Agent · Lovable · Manus
auth: hosted sandbox · project credentials · budget and kill switch
custom
built on agent frameworks
human in the loop
the specialist
proposes one expert move
examples
Mastra · OpenAI Agents SDK · Eve
auth: user-scoped tools · escalate before irreversible act
autonomous
the actor
acts inside a policy fence
examples
Flue · Cloudflare Agents SDK · Vercel AI SDK
auth: agent principal · allow / deny / ask per action
The map is a product brief. Choosing a cell locks three roadmap decisions: who holds the credential, what the person sees at judgment time, and what artifact comes back when the run ends.
the product mistake
Teams treat those three decisions as security chores for later. Those decisions are the product.
Credential choice selects the interface you must ship:
- user's session → reversibility UI (plan, diff, undo)
- bot in a sandbox → handoff UI (branch, checks, review)
- on behalf of you → provenance UI (sources, status, steer)
- hosted project credentials → ops UI (budget, heartbeat, kill)
- user-scoped tools with approve → evidence UI (action, consequence, yes/no)
- agent principal with policy → policy UI (allow / deny / ask per action)
A scheduled operator with Claude Code's chat stream buries the user in noise. A money-moving actor with a research-report UX gives a confident summary and no enforceable fence. You shipped cell A's interface for cell B's risk.
field notes: what each cell demands
coding × human in the loop
the pair
auth
your session · your credentials · approve protected actions
failure
approval becomes a reflex
Claude Code, Cursor, and Codex CLI. The agent is you with a faster keyboard: your keys and your repo.
Permission modes work here because the person can still see the blast radius. Ship an editable plan, a readable diff, and undo faster than the damage. An approval prompt that hides the action trains the user to click yes.
coding × autonomous
the worker
auth
sandbox VM · scoped repo token · PR from agent identity
failure
green checks hide a bad handoff
Cursor Cloud Agents, Devin, Jules, Copilot coding agent. Issue in, branch or PR out. Jules clones into a Google Cloud VM. Copilot coding agent runs in GitHub Actions after you assign the issue. The credential is a bot identity in a sandbox.
Ship a reviewable handoff. Name what changed, what failed, and what still needs a human with merge rights. Pair-style step streams belong in the IDE. Here the PR carries the product.
background × human in the loop
the delegate
auth
on behalf of you · bounded task · review before use
failure
the work drifts silently
ChatGPT deep research, Gemini Deep Research, Perplexity. The agent leaves, works on your behalf, and returns a report. Gemini can also read Gmail and Drive when connected.
Ship provenance without transcript babysitting: sources, status, a steer point. "Watch the thinking" is pair UX wearing a research label.
background × autonomous
the operator
auth
hosted sandbox · project credentials · budget and kill switch
failure
cost and retries run away
Replit Agent, Lovable, Manus. Hosted sandboxes that keep going after you close the tab. They look like coding products. The run lives in the vendor's cloud, and the job is "ship the thing" more than "open a PR on my existing repo."
Ship budget, heartbeat, and a kill switch before the first unattended night. Pair-density approvals kill the value. PR review may miss the artifact. Ops controls fit this cell.
custom × human in the loop
the specialist
auth
user-scoped tools · escalate before irreversible act
failure
the reviewer approves blind
Mastra, OpenAI Agents SDK, Eve: frameworks for the agent you ship inside your product. This cell is the SaaS pattern most product leaders want: propose one expert move, then wait.
Wire approval into the tool call. Mastra's requireApproval and workflow suspend, OpenAI
interruptions, Eve HITL prompts. Ship evidence, the exact action, and the consequence of yes.
Without that packet, the reviewer has nothing to judge.
custom × autonomous
the actor
auth
agent principal · allow / deny / ask per action
failure
one broad credential escapes the fence
Flue, Cloudflare Agents SDK, Vercel AI SDK (and Eve or Mastra once you add schedules and drop approval gates). Durable runtimes, worker-bound principals, tools you wrap in policy.
This is where teams building AI-powered apps get hurt. They put user OAuth into an unattended loop because the demo was easy. Ship a separate agent principal, allow / deny / ask per action, budgets, and receipts. Nominee is the enforcement layer I built for that boundary. Put the fence in before chat polish.
if you are building the product
Devtools and AI apps fail in different places on the same map.
Shipping a coding agent. Decide pair vs worker early. Pair means you own reversibility in the IDE. Worker means you own the handoff contract on the PR. Skip the primary cell and you get a chat that sometimes opens PRs and an approval UX that sometimes sleeps.
Shipping a hosted builder. You are in operator territory even when marketing says "AI coding." Replit and Lovable compete on sandbox, time-to-artifact, and recovery when the run goes wrong. Compete on those. IDE permission modals belong to the pair.
Shipping an agent inside your app. You are on the custom row. Framework choice (Mastra, Eve, Flue, OpenAI Agents SDK, Cloudflare Agents, Vercel AI SDK) buys you the loop. You still choose the cell. For each tool, pick allow, deny, or ask. For each run, pick whose credential fires. For each irreversible action, pick the evidence packet a human must see. That work is the product, and it is independent of which model you call.
decide in this order
- Surface. Codebase, away from the foreground, or a custom agent inside your product.
- Autonomy default. Person holds the wheel for the primary job, or the agent does.
- Principal. Your session, on-behalf-of delegation, bot/sandbox identity, or a separate agent principal.
- Escalation. Actions marked allow, deny, or ask, written as a list.
- Artifact. Diff, PR, report, deployed app, or policy receipt the user inspects on return.
- Kill. Budget, time, tool-call cap, or human revoke that stops a bad run.
Leave those blank and you still have a model demo.
where the map breaks
Products sit on more than one cell. Jules is a coding worker that also leaves the foreground. Replit Agent looks like coding and runs as an operator. A custom specialist can write code. Pick a primary coordinate so the team knows which interface and credential model to protect. Keep secondary behaviors secondary.
Autonomy also varies by action inside one product. Cheap reads can run unattended. Hard-to-undo writes need ask. The map's two modes make the default visible. You still write the action-level policy. Model quality will move. The cell you chose still decides who holds authority when the model is wrong.