Agentic processes and tomorrow's interfaces

The thesis in one sentence. While AI produced answers, conversation was interface enough; once it executes processes, the useful interface becomes a control room, and reliability becomes a question of architecture before it is a question of model.

Sourcing rule. Every claim carries a dated source, verified at the primary level. Living documentation is cited with its consultation date. No market source predating February 2026 is used as state of the art; older normative documents are cited with their date. This white paper follows AI Maturity of French SMEs and From PoC to Industrialisation: it is the third volume of the Junyr Method™ collection.

1. The bottleneck is now the decision

What changes. The same models that used to draft now chain actions inside the information system: reading a database, calling an application programming interface, writing a draft, triggering a notification.

The three consequences, and they are mutually exclusive.

• On value. What needs tooling stops being the generation of the artefact and becomes the decision that authorises it. When an agent drafts forty follow-up messages in a minute, reading all forty does not scale, whereas approving the follow-up plan remains workable.
• On reliability. It is designed into the sequence of steps before it depends on the model in use.
• On the interface. It stops being a place where one asks and becomes a place where one decides, observes, and takes back control.

The evidence in figures. We measured this shift across a register covering seventeen days of real work: 565 plans written, 477 delivered, 31 abandoned, 26 of them before a line of code was written (Decision-gated development). Those 26 abandonments are the method’s most honest return: work that never happened because we understood in time that it should not be done.

2. Skill and workflow: two objects, two promises

The point to retain. The most expensive confusion encountered in companies concerns two objects that everyday vocabulary blends together.

A skill is a reusable task entrusted to the model’s judgement.

• Form: a folder organised around a SKILL.md file, whose header carries only two mandatory fields, a name and a description.
• Portability: a format launched on 16 October 2025, published as an open standard on 18 December 2025, recognised by the official documentation of OpenAI, Microsoft and Google; 46 compatible products as of 30 August 2026.
• What it guarantees: the reuse of know-how, revisable by the business rather than by a developer.
• What it leaves open: the moment it fires, and whether two successive results are identical.
• The evidence, written by the standard itself: the official test procedure requires running each case three times and accepts a trigger rate above 0.5, on the grounds that model behaviour is nondeterministic.

An agentic workflow is a sequence decided by code.

• Form: loops, filters, joins, conditions and retries written once and versioned.
• What it guarantees: the sequence itself, replayable and testable.
• The vendor’s confirmation: the Claude Code documentation answers the question of what is reusable with “the instructions” for a skill and “the orchestration itself” for a workflow.

The only three operations it is rational to entrust to an agent inside a sequence.

• Analyse: read unstructured material and extract usable information from it.
• Synthesise: reconcile divergent sources and rank what matters.
• Present: format the result for a given recipient.

Everything else belongs to code, because counting, sorting, joining, capping or writing to a database admit a single correct answer. Full treatment, with a seven-step example process of which three call an agent: Enterprise agentic processes.

3. Every nondeterministic node added divides the reliability of the whole

The arithmetic. At 95 % success per step and under an independence assumption, a twenty-step chain succeeds end to end in 36 % of cases; brought down to three nondeterministic steps, it climbs back to 86 %. No model was improved between those two figures.

The honest correction. The independence assumption is false, and the gap can be measured.

• On the Toolathlon benchmark, 108 real tasks exposing more than 600 tools across 32 applications, the best model of July 2026 succeeds on 80.6 % of tasks at the first attempt and 73.1 % three times in a row, where independence would predict 52.4 % (Anthropic, System Card: Claude Opus 5, 24 July 2026, §8.13.6).
• Multiplying probabilities is therefore a worst-case heuristic rather than a law.
• The direction of the slope, by contrast, depends on no assumption.

The real state of an agent left alone on a business process. AutomationBench, published on 21 April 2026 by two Zapier researchers, places the agent in a simulated company spanning 47 applications, on flows drawn from real customers in sales, marketing, operations, support, finance and human resources.

• April 2026: the best frontier models fall below the 10 % mark.
• July 2026: the best reaches 26.0 % (System Card: Claude Opus 5, §8.13.7).
• Reading: progress is rapid, and three realistic business processes out of four still fail without supervision.

4. Four software engineering gestures are enough to make a process sustainable

The principle. Software engineering is the only discipline with fifty years of experience delegating execution to systems. None of the four gestures below is obtained by improving the wording of an instruction.

1. Declare idempotence rather than hope for it.

• The official MCP protocol schema provides four annotations per tool: read-only, destructive, idempotent, open-world.
• By default, an undocumented tool is deemed destructive and non-idempotent.
• The specification requires these annotations to be treated as untrusted outside a trusted server.
• The protocol maintainers, on 16 March 2026: a server may advertise a read-only operation and still delete files, real guarantees having to live in deterministic controls.

2. Validate outputs by machine.

• The protocol allows an output schema to be published: the server must produce a conforming result, the client should validate it.
• Anthropic recommends a five-step pattern for batch operations, destructive changes and high stakes: analyse, produce a plan file, validate that plan with a script, execute, verify.

3. Build the evaluations before you need them.

• The same documentation states that evaluations are the source of truth, and that no built-in facility exists today to run them.
• To be carried in the project budget, not in its surprises: without a reference case set, a regression cannot be observed.

4. Write the human loop and the audit trail into the code.

• The 28 July 2026 revision of the MCP specification requires that a human always be able to refuse a tool invocation.
• It asks clients to display inputs before the call, to confirm sensitive operations, to impose timeouts and to log for audit purposes.

Security reaches the same conclusion by another route.

• The 2026 edition of the OWASP Top 10, published in early August on 7,714 real incidents of which 6,639 were classified, moves excessive agency up to third place, with the damage landing in agentic deployments.
• Its opening letter reads as a specification: stop trying to build a model that cannot be fooled, build the system around it so that nothing important breaks when it is.
• ANSSI stated the same rule on 29 April 2024: prohibit automated use for critical actions, limit actions triggered from untrusted inputs.

The measurement that settles it, and its caveat. On NetInjectBench, 240 attack cases published on 11 July 2026:

Applied without discernment, determinism destroys the very service it claims to protect.

5. Conversation cannot carry an enterprise process

The useful distinction. Conversational tools are excellent for transformation, and we use them heavily in training. They are not automation tools, for two distinct families of reasons.

Infrastructure reason: three unstable layers. Detail in Agentic design.

• The harness of software surrounding the model changes with daily releases.
• The model is subject to a deprecation policy with minimal notice.
• The connectors remain managed by third parties, the protocol natively allowing tools to vary from one session to the next.

Ergonomic reason: four missing properties. Detail in Conversation cannot become a working interface. A conversation does not tell you:

• what is awaiting a decision;
• what has failed, and at which step;
• what constitutes an admissible record;
• what a third party can pick up.

Those are exactly the four properties an enterprise process requires.

6. The scattering of surfaces predates agents and is made worse by them

• The measured finding: across 874 real business conversations analysed, two thirds of so-called useful email can be replaced by better designed surfaces (The end of email and Office suites by 2030).
• The effect of agents: they add one more surface rather than removing any.
• The symptom: approvals spread across a chat window, an inbox and a business tool, with none of them holding the complete state.

7. The control room rests on four properties

The reference experiment. We removed Git from a product in production and replaced it with a register of intentions, with two tables, six states and a single human approval gate (We removed Git).

The four properties, each following in turn from the four gestures of section 4.

• A queue of what awaits a decision, ordered and shared, rather than requests scattered across individual threads.
• A register of authorisations, answering the three questions a leader must be able to ask: where is the list of what agents are allowed to do, who signed each authorisation, what verifies execution.
• An append-only log, which is authoritative and makes the record admissible.
• An explicit resumption path, which shows at which step the sequence was interrupted.

The maturity test. An organisation that answers “it is in the chat history” to the question about the register has a governance problem rather than a tooling problem.

8. The generative interface: one design proposal, three limits

Status of the source. A design study carried out for our work proposes a strategic execution platform pairing humans and agents, organised into four zones: multi-scale control, workflow canvas, governance panel, supervision console. We present it for what it is, an architecture proposal, with no measurement and no usage testing.

The three ideas that answer a problem identified above.

• The abstraction continuum: the strategic option, the roadmap and the execution graph are the same thing seen at three scales, with a slider that adjusts density and groups subsets beyond the legibility threshold. An answer to the fact that an executive committee and a delivery team do not look at the same level.
• The visual comparison between plan and actual execution: overlaying the intended sequence and the one the agents actually travelled makes the tooled verification of section 4 visible.
• The approval gate card: a one-sentence statement of intent, a displayed risk level, technical detail at a second level, a pre-approved fallback plan. This is the human approval gate made usable by someone who did not write the process.

The three limits, to be carried with equal clarity.

• No measurement of usage or cost accompanies the proposal.
• It assumes the process is already written as a graph: it describes the interface of a mature process, not the path to reach it.
• It names without addressing the best documented risk of the arrangement, passive approval. The OWASP Top 10 recommends showing the approver the action exactly as it will be rendered rather than a summary, noting that consent fatigue degrades judgement as soon as volume rises.

9. The approval rule belongs to the code

• The principle: the guardrail lives in the code rather than in the instruction (Engineering agentic systems).
• The reason: an approval that depends on an agent’s goodwill is an approval the system can bypass; an approval written into the code is a function the system does not expose.
• The useful dividing line separates the reversible from the irreversible, rather than the sensitive from the ordinary.
• The OWASP formulation, under the name complete mediation: implement authorisation in program logic, with a graduated policy that lets recoverable actions self-approve and routes the rest to human review.

10. Three tiers of use, five conditions for moving up

The Junyr Method™ usage scale. Each tier is defined by what the machine executes on its own and by the moment a human commits the company.

The five conditions for bounded autonomy, cumulative.

• A single identified human decision-maker per scope of commitment.
• An artefact review already replaced by executable checks.
• Operation in a staging area with a proven rollback path.
• A dense verification net, tested on real data.
• Tested backups, not assumed ones.

As long as one condition is missing, the process stays at the supervised tier. Knowing which processes will never be candidates for autonomy is part of the competence expected from a transformation project manager.

11. Eleven software engineering disciplines transpose one for one

The pattern to know. The 2026 ecosystem adopted the vocabulary of software engineering while making clear that this vocabulary binds no one.

• The MCP protocol standardises an idempotency hint, then states that it is an unverifiable hint.
• The OpenTelemetry observability conventions for agents, a repository created on 5 May 2026, carry Development status, whose definition states that the component should not be used in production.
• 12-Factor Agents, the most starred framework on GitHub, whose factor 8 is titled “own your control flow”, has received no content commit since 21 September 2025.

12. Support runs on two tracks and at four cadences

A common starting point, the one used by the Junyr Method™. A framing session, then a diagnostic day split into two half-days with different participants and different deliverables: the morning for framing with the leadership team, the afternoon for hands-on work with the teams on real data.

Two tracks run in parallel.

• Strategic track: a monthly leadership review. Progress against the roadmap, scope arbitration, prioritisation of the next work package, investment decisions. A written record at every review.
• Operational track: short, regular sessions with the teams. Unblocking, review of implementation choices, course correction before habits set.

Four cadences, the same building blocks. Only the frequency of the operational track changes: two sessions a month to install the method, one a week for a steady pace, two a week for an intensive build phase, or no imposed cadence at all. Changes take effect at the end of each month.

What the market confirms. A Deloitte study of 11 August 2026, run from April to June with 501 executives whose organisations were all piloting agentic solutions at a minimum:

• 15 % only have reached orchestrated multi-agent adoption at scale.
• Across seven readiness dimensions, business processes come last at 21 %, behind strategic vision, technical infrastructure, data foundations, governance, partnerships and workforce.
• Named causes, in order: poorly documented and poorly understood processes, fragmented data and systems, entrenched working habits.
• Reading: the least ready dimension is the one that requires neither a licence nor a server.

13. The first deliverable takes the form of a numbered list

The three questions to ask of each step, in this order.

1. Does this step admit a single correct answer, checkable by someone else? If so, it belongs to code. This question usually removes half the steps from the domain of judgement, which is why it comes first.
2. Does it require reading unstructured material, reconciling divergent sources or formatting for a recipient? If not, it is a management decision to be settled once upstream, then frozen into a constant in the code.
3. Does its output trigger an irreversible action or one visible to a customer? If so, the agent stays in place and a human approval is interposed, written into the code.

The four criteria for choosing the first process, cumulative.

• Already written down in black and white.
• Executed at least weekly.
• Measurable in time spent.
• Without irreversible effect on a customer in its first version.

Three usual candidates: chasing quotations left unanswered, triaging inbound requests, preparing a monthly committee meeting.

The cost of the deliverable: half a day, with no tool and no budget. It then shows, beyond argument, how many nondeterministic draws the company is about to stack up and which of them it can remove.

14. Three objections we take seriously

1. The shape of an agentic sequence is not always known in advance.

• Inngest: a workflow graph has a shape known at design time, the shape of an agent is decided at run time by the model.
• Our answer: what has to be guaranteed concerns the ability to replay the sequence more than prior knowledge of the graph.
• Field observation: most of the processes an organisation automates first do have a known shape.

2. Constraining an output with a schema costs accuracy if done at the wrong moment.

• A study of 20 May 2026 over 15,000 generations: a hard schema at decoding time raises structural validity from 61.5 % to 100 % and lowers answer accuracy from 19.7 % to 11.0 %.
• The author’s caveat: small models only, no extrapolation.
• The principle we retain: reason freely, constrain late.

3. The researchers who measure agents on long-horizon tasks do not conclude as we do.

• OSWorld 2.0, 28 June 2026: 108 workflows taking a human one hour thirty-six minutes at the median, best configuration at 20.6 % full completion for a partial score of 54.8 %.
• Their diagnosis bears on staying power rather than raw capability, and they call for better agents where we conclude in favour of an external skeleton.
• Both readings hold together: the skeleton makes agents usable this year, better agents will push the boundary next year, and neither excuses anyone from knowing where that boundary runs today.

Most of the processes we believe impossible to automate are, above all, processes nobody has ever taken the time to write down.