Declared, not scraped

Last reviewed: July 2026.

There are two ways an AI agent can operate an interface a human is looking at. It can scrape: read the DOM (or a screenshot), apply heuristics – "that looks like a button" – and hope the UI doesn't change underneath it. Browser-automation agents work this way because they must: arbitrary web UIs carry no contract about what is intended to be machine-operable. The costs are structural: fragility under change, a model call (sometimes a vision call) per look, and no principled answer to "was the agent even allowed to press that?"

Or the interface can declare. In Fuaran, operability is a typed field on the node: each node lists the affordances it exposes to agents – pressable buttons, settable fields, selections – each with its identifier, its typed decoder, and its authorisation annotation. The agent's tool catalogue is a projection of the live tree, not a hand-maintained registry beside it, so the catalogue and the rendered UI cannot drift apart; the build-time validator checks the declarations against the node's actual shape before anything ships.

Three consequences are worth singling out:

• Closed value spaces are projected up front. A field whose legal values are a fixed set – countries, currencies, statuses – carries the exhaustive list in its declaration, projected to the agent at session start. "Set the shipping country to the UK" resolves in one step, because the agent already holds the enumeration. The guess-and-correct loop ("United Kingdom"? rejected; "Great Britain"? rejected...) never starts. Where a space is open, the typed decoder still rejects bad values with the supported alternatives (Errors that enumerate the fix).
• Permission is visible in the source. Authorisation is a typed annotation on the affordance – always controllable, never AI-controllable, scope- or consent-gated. A "never" on a destructive action is grep-able and code-reviewable, and never-allowed affordances are omitted from the agent's catalogue entirely rather than discovered by refusal. Contrast a runtime policy middleware: the same prohibition exists, but no reviewer can see it in the UI's source and the agent learns it only by trying.
• Concurrency with the human is per-node, not a banner. A node the user is mid-interaction with – a focused field, an open dropdown – is paused, as typed lifecycle state; the grid she's filtering is off-limits while the sidebar stays operable. An agent operating a paused node gets a structured envelope naming the cause, not a race against the user's keystrokes.

Scraping agents and declared surfaces will coexist – the open web is a long tail no contract covers, and vision-driven agents are the right tool there. The argument here is narrower: for interfaces you author, making the agent guess is a choice, not a necessity – and everything downstream of the guess (fragility, latency, authorisation by trial) is a cost you opted into.