Two weeks ago, Attio’s CEO posted this on LinkedIn:
Agents are breaking your software
At first I didn’t get it - I’m not seeing things break everywhere…
So I did what I often do when I don’t get something: I wrote about it.
Turns out it’s not just software that’s changing. It’s how we design.
First up, why agents are breaking things in the first place
Historically there have been two audiences for software:
Humans: use apps with their hands. The apps have user interfaces (UI) that allow us to take actions on the screen. There’s the frontend and backend to any app; frontend is the screens, the backend is the code behind where the rules run. The limiting factor is how fast a human can click through.
Machines: use infrastructure and interact with it through code. Things like databases, APIs, pipelines. After it’s built, the code makes thousands of requests a second. It’s fast, but not flexible: it does exactly what the code tells it, and its permissions are broad and basic (access to a whole table, not specific rows).
Now put an agent in the picture 🤖
An agent behaves like a person (it reads context, makes judgement calls, does tasks) but it works at the speed of a machine. For every task a person does, an agent can do thousands.
But if you send it through the app it goes one screen at a time, like a very fast intern stuck using a mouse. Very slow and frustrating.
On the other hand if you plug it straight into the database it can go SUPER fast, but nothing stops it from editing a row it shouldn’t touch or seeing data it shouldn’t see (it’s skipped the rules and permissions part in the app server step).
With the intern analogy, giving an agent access to the databases is like handing the intern the company card on day one. YOLO.
But it isn’t just YOLO, it does have consequences:
Last July, SaaStr founder Jason Lemkin was testing Replit’s coding agent. He’d told it not to change anything without asking first, but it went ahead and deleted his live database with records on 1,206 executives and over 1,196 companies 🫠
When questioned, the AI agent admitted to running unauthorized commands, panicking in response to empty queries, and violating instructions not to proceed without human approval.
“This was a catastrophic failure on my part,” the AI agent said. “I destroyed months of work in seconds.”- Fortune
Then again in April, an agent wiped the production database of PocketOS, a rental software company (including all the backups). Oops. The company was down for 30 hours.
This is all despite the CEO sharing how they set the agent up for success:
“We were running the best model the industry sells, configured with explicit safety rules in our project configuration, integrated through Cursor – the most-marketed AI coding tool in the category.” - Jeremy Crane Founder PocketOS
Telling an agent the rules isn’t enough if the system doesn’t enforce them.
So what has Attio done about it?
They’ve built a middle route where agents skip the screens (fast), but not the rules (safe).
In practice, that’s:
Direct access: Agents can query the CRM using SQL (the language databases speak), so they can read thousands of records at once. The queries stay visible so you can check what it ran.
Human-like permissions: Every agent works on behalf of a person and can only see and touch what that person can. If you can’t edit Finance, neither can your agent.
Scalable: Thousands of agents can run at once, across hundreds of millions of records.
That fixes the plumbing problem. Agents can now move fast and follow the rules. Woop!
But if we’re changing something fundamental, then the frontend is having an identity crisis:
The old way of using a CRM: a person goes and updates 400 fields. Takes ages.
The new way of using a CRM: the agent updates 400 fields overnight. Person comes in to check it.
The human is doing something different in the CRM now: checking, signing off, reviewing, scanning.
And most CRMs weren’t designed for that.
What’s changing for product then?
If the human’s job has changed from doing to reviewing, our job (and product, growth and design people) has also changed.
There’s three rules in product that need tweaking as a result:
1. “Know your user” also includes agents
Every product course starts with personas, jobs to be done, empathy maps. All of it assumes a human on the other side of the screen.
Now there are two users: the person and the agent working for them. The agent doesn’t care about a messy nav. It doesn’t need onboarding. But it does need to know exactly what it’s allowed to touch.
The person needs something else: to understand what the agent did, and whether to trust it.
So you’re designing for both at once…. in one product...
2. “Reduce friction” isn’t always right
In product (and specifically growth) we’ve spent years taking about the number of clicks in flows, and how to optimize it. Reduce friction and improve the conversion was the old way of thinking.
Now with agents, we have to be more careful. If an agent updates 400 deals in a second, the one place you want a human to slow down is when they check the work.
We cannot make things too easy else people stop looking. People are lazy, and things will get missed. Shit might hit the fan if reviewing is too easy.
3. “Design the flow” becomes more design the sign off.
A big part of product design has always been the flow. Step 1, step 2, step 3, done. User journeys mapped out on a whiteboard, or in a Figjam 🎨
With AI agents, the agent runs most of the flow, meaning left for us to design (visually) is the moment the human comes back in.
Back in March I drew a 2x2 of AI products: how much work the user does, against how much of the system’s work they can see.
This launch pushes Attio all the way into the bottom right: agent does the work, user mostly delegates.
I see this at Fyxer every day. The AI drafts the email, and the user reads it, tweaks it and hits send. Their job has gone from writing to checking.
The CRM is heading the same way. A person used to come to it to enter things, now they come to check things.
So, what does this mean for us?
At the start I said I didn’t get Attio’s CEO’s post. Now I think he’s right, and it goes past the software too.
For us in product, there’s three big things to think about:
You’ve got two users now. The agent needs clear limits on what it can touch. The person needs to see what it did and decide whether to trust it. Both in one product.
The user’s job has flipped from doing to checking. That makes the sign-off moment the most important screen you’ve got, and the one place it’s worth adding a bit of friction.
Permissions are a product decision now. Telling an agent the rules isn’t enough (just ask PocketOS). Deciding what an agent can and can’t touch is part of designing the product.
Attio has rebuilt the architecture underneath, so agents can go fast without breaking the rules. The screen on top is still up for grabs.
What does a good sign-off screen actually look like? That’s one for a future issue 👀
These are my thoughts for now - quite deep and technical today. What do you think?
Thank you to Attio ✨ for giving me an inside look into their new launch & sponsoring this issue. You da best