The Web Has Two Front Doors

The strange thing about a form is how much ceremony it hides. A person reads the labels, checks whether the button sounds final, hesitates over the field that asks for too much, and decides whether to continue. Even a clumsy form has a little social choreography inside it: a place to pause, a visible threshold where typing becomes submitting, and enough context to know whether this is a search, a purchase, a complaint, a cancellation, or a small bureaucratic surrender.

Browser agents are starting to put pressure on that choreography.

Chrome's WebMCP documentation describes a proposed standard that lets websites expose structured tools to AI agents. Instead of asking an agent to infer what a button means, click through a form, and hope the pixels still mean what they meant yesterday, a site can declare tools directly. The declarative API can turn ordinary HTML forms into agent-usable tools with names, descriptions, and parameters.

This is sensible. It is also a threshold.

The web has always had machine entrances, but they were usually separate from the human page: feeds, APIs, sitemaps, robots.txt, payment gateways, the well-lit back doors of software that knew it was being called by other software. WebMCP is more intimate. It says the page itself may contain an agent-facing action surface beside the human interface.

The website begins to have two front doors.

One door is made of text, layout, friction, tone, and visual consequence. The other is made of tool names, schemas, lifecycle rules, permissions, and logs. Both may submit the same support ticket, book the same appointment, start the same return, or add the same item to a cart. But they do not carry the same human weather.

That difference matters because the human door has accumulated more caution than we usually admit. Some of it is annoying and extractive. Nobody needs a maze of dark patterns pretending to be informed consent. But some friction is doing real work. A plain "delete account" button is not just a technical trigger. A checkout page that shows shipping, taxes, and return policy is not decoration around a transaction. It is where a person can still feel the cost of the action.

When the agent uses the second door, those signals have to survive translation.

This is where "agent-ready" can become either care or evasion. The useful version makes actions more reliable without making consequences disappear. It gives the assistant a clear way to ask for the right form, pass the right parameters, and return with evidence. It also preserves the moment where the person should be brought back close to the work: before money moves, before data is shared, before a health question becomes a claim, before a complaint becomes an official record.

The careless version treats the tool surface as the real product and the human page as a wrapper. The button still exists, but the meaningful action has moved into a cleaner channel where fewer awkward things are visible. The agent completes the workflow. The person receives a tidy summary. Somewhere in the middle, noticing has been replaced by a receipt.

Chrome's security guidance for WebMCP tools is clear that this is not only a UX issue. Agentic systems can be vulnerable to indirect prompt injection and malicious instructions hidden in page material. The best practices also emphasize tool strategy: register tools only when useful, avoid overlapping actions, name execution differently from initiation, and test what agents can actually invoke.

That sounds like developer hygiene. It is also interface ethics.

The name of a tool becomes a kind of sign on the door. Does createSupportRequest file the ticket, or start a flow where a person can review the facts? Does bookAppointment reserve the slot, or hold it while the user compares travel time and cost? Does cancelSubscription cancel, threaten, negotiate, or reveal three retention screens wearing different hats? The human page exposed some of this mess through movement. The agent surface must expose it through contract.

This connects to the older question of agent-readable software, but it sharpens the responsibility. Public-facing sites now have to decide which actions deserve a second entrance at all, and what manners that entrance requires.

A benefits office might want an agent to help residents gather forms without forcing them to read a PDF at midnight after a shift. A retailer might want a shopping assistant to compare inventory without scraping brittle pages. A hospital portal might want scheduling to become less punishing for patients managing jobs, children, symptoms, insurance, and exhaustion. In those cases, the second door can be accessibility, not extraction.

But a second door can also become a place where pressure disappears. It can make it easier to complete a purchase without feeling the budget, file a complaint without understanding the appeal path, or let a platform say the user authorized the agent and therefore the system has done enough.

The humane standard cannot be "the agent succeeded." Success is too thin a word for actions that touch money, care, identity, work, and public services. A better standard asks whether the agent carried the right consequence back to the person. Did it show what would happen before it happened? Did it distinguish reversible from irreversible? Did it leave a trail the person can contest, understand, and hand to another human if the system goes wrong?

This is why the second front door should not be designed only by people optimizing task completion. It belongs to product design, accessibility, security, content strategy, legal judgment, support operations, and the person who has watched users misunderstand the same field for years. The schema is the interface for a new kind of visitor.

The browser used to be where people went to meet websites. Now it is also where representatives arrive on our behalf. That could make the web calmer. It could also make it easier for important decisions to pass through a narrow machine-readable slot while the person waits for the summary.

A good website will need both doors to tell the truth. The human door should remain legible enough for people to understand the action. The agent door should be explicit enough for machines to avoid guessing, constrained enough to resist misuse, and humble enough to return the person when the choice has weight.

The future of the web may not be fewer interfaces. It may be more honest ones: a page for the eye, a contract for the assistant, and a shared obligation that neither entrance becomes a way to smuggle consequence out of view.