"Agent" now covers six products that run the same model loop with different credentials.
Claude Code runs in your session and pauses before protected actions. A Cursor cloud worker opens a PR from a scoped token in a sandbox. Gmail filters move mail while you sleep under rules you set once. Product teams file all three under "agents" because each one calls a model with tools. The shared loop hides who actually holds authority.
Pick a surface and an autonomy mode before you write a prompt:
- surface: coding, background, or domain
- autonomy: human in the loop or autonomous
Three surfaces times two modes gives six cells. The map labels each cell with examples and an auth line: who acts, with which credential, and what still needs a human.
field guide no. 01
the agent surface map
authority moves right →
human in loop
person holds the wheel
autonomous
agent holds the wheel
coding
inside the codebase
human in the loop
the pair
you steer; it moves
examples
Claude Code · Cursor · Codex
auth: your session · your credentials · approve protected actions
autonomous
the worker
issue in; branch out
examples
Cursor Cloud Agents · Devin · Replit Agent · Lovable · v0
auth: sandbox VM · scoped repo token · PR from agent identity
background
away from the foreground
human in the loop
the delegate
leaves; returns with proof
examples
Claude Code subagents · ChatGPT research · Perplexity
auth: on behalf of you · bounded task · review before use
autonomous
the operator
runs while you sleep
examples
Cursor scheduled agents · GitHub agent workflows · cron monitors
auth: service identity · scoped tokens · budget and kill switch
domain
inside a bounded workflow
human in the loop
the specialist
proposes one expert move
examples
Stripe Radar · Zendesk AI · TurboTax Assist
auth: your account to read · escalate before irreversible act
autonomous
the actor
acts inside a policy fence
examples
Zapier AI · Power Automate · Gmail filters
auth: separate agent principal · allow / deny / ask per action
the moment this clicked
I built this map while working on nominee.dev, a side project about agent permissions.
The agent needed to read mail, maybe forward it, and never delete without me in the loop. I kept
reaching for coding-agent patterns: plans, diffs, undo. That fit Claude Code. It did not fit
email.forward to an unknown address.
Coding agents run as you. Background researchers run on your behalf inside a bounded task. Domain agents need a separate principal, a policy fence, and receipts per action. Nominee evaluates each tool call as allow, deny, or ask. Stripe Radar flags a charge for you to review. Zapier fires a step when a trigger matches. Same loop. Three credential models.
Once I separated surface from authority, the category split. The interface followed.
field notes from each cell
coding × human in the loop
the pair
auth
your session · your credentials · approve protected actions
failure
approval becomes a reflex
Claude Code, Cursor, and Codex sit in this cell. The agent uses your login. Your keys. Your repo access. Claude Code's permission modes make that visible: read the tree, propose a plan, pause before protected actions.
The product question is where approval lives. A prompt without the action and its consequence is permission theatre. A fast undo matters because the credential is yours.
coding × autonomous
the worker
auth
sandbox VM · scoped repo token · PR from agent identity
failure
green checks hide a bad handoff
Cursor Cloud Agents, Devin, Replit Agent, Lovable, and v0 hand you a branch or PR. The run happens in a sandbox or cloud VM, not on your laptop. The handoff often comes from a bot identity with a scoped token.
Contain the environment. Run tests. Name what changed, what failed, and what still needs a human with your credentials. A green check from the agent account is not the same as a merge you would sign.
background × human in the loop
the delegate
auth
on behalf of you · bounded task · review before use
failure
the work drifts silently
ChatGPT research, Perplexity, and Claude Code subagents leave the foreground, work on your behalf, and return an artifact. You review before the output enters your workflow.
Auth here is delegation, not impersonation. Scope the task. Require sources. Keep a checkpoint where you can steer without reading the full transcript.
background × autonomous
the operator
auth
service identity · scoped tokens · budget and kill switch
failure
cost and retries run away
Cursor scheduled agents, GitHub agent workflows, and cron monitors run on a schedule or trigger. The credential is a service account or workflow token, not your daily driver login.
Cap time, money, and tool calls before the first unattended run. Add a heartbeat and a kill switch. When no human is watching, recovery depends on the scope you gave the service identity.
domain × human in the loop
the specialist
auth
your account to read · escalate before irreversible act
failure
the reviewer approves blind
Stripe Radar, Zendesk AI, and TurboTax Assist propose one expert move inside a bounded workflow. The agent reads through your account. You approve before the irreversible step.
Show the evidence, the exact action, and what happens if you click yes. A modal without that context turns the reviewer into a rubber stamp.
domain × autonomous
the actor
auth
separate agent principal · allow / deny / ask per action
failure
one broad credential escapes the fence
Zapier AI, Power Automate, and Gmail filters act inside rules you defined earlier. The principal is the automation itself, not you at the keyboard.
Nominee sits here too: separate agent identity, allow / deny / ask per tool call, budgets, and receipts. Gmail's filter is the consumer version. One broad OAuth grant turns the fence into decoration.
what the map changes
Each surface pairs with an auth model:
- coding agents default to your session. Design for reversibility.
- background agents run on behalf of you or a service account. Design for observability and scoped delegation.
- domain agents need a bounded principal. Design for action-level authority.
Supervised cells raise the bar for legibility at the approval point. Autonomous cells raise the bar for scope on the credential.
One interface across all six creates friction. A paired coding session wants a stream of steps and diffs. A scheduled operator would bury you in noise. A specialist wants one decision with full context. An actor needs a policy, not a chat window.
the practical test
Fill this sentence before you build:
We are building a [coding / background / domain] agent in [human-in-the-loop / autonomous] mode. It acts as [your session / on your behalf / separate principal] for [specific actions]. It escalates when [condition].
Then answer:
- Who holds the credential during a run?
- Which actions can execute without a prompt?
- Which actions require your account versus a scoped token or service identity?
- Where can a person inspect state without watching a transcript?
- What artifact does the agent return?
- What kills the run if budget or scope breaks?
Skip the auth line and you have a model demo, not a product.
where the map breaks
The surface axis mixes job and execution. Coding and domain describe the work. Background describes where the run lives. A remote coding agent wears two labels. A domain agent can still write code.
I keep the labels because teams use them, and picking a primary surface exposes the credential model you have to design. Treat the cell as a coordinate, not a cage.
Autonomy also varies by action inside one product. Cheap reads can run unattended. Expensive or hard-to-undo actions need ask rules. Two modes on the map make that design choice visible. The full policy still lives at the action level.
Model capabilities will keep shifting. Your team still picks where the agent works, who holds the credential, and which actions run without you in the room.