"Yeah, hi...so I...[dog barking] sorry, hold on...so I got my bill and it's way higher than norm...actually, is this even the right number for billing? I added a line last month for my daughter and —"
The IVA hears one word: billing. It asks her to confirm. She says yes, but it's about the new line, she's headed to college. The system doesn't have a slot for that.
"I'm sorry, I didn't get that. You can say: pay my bill, make a change, or technical support." She says she doesn't want to pay it, she wants to know why it went up. Estimated wait time: 23 minutes.
Eight seconds. In that window the caller was interrupted by her dog, interrupted herself, questioned whether she'd reached the right number, told the system exactly why her bill rose—a new line—and pivoted to the reason behind it. The script flattened all of it into a single keyword and dead-ended her into a hold.
Five9, whose transcript this is, is blunt about the diagnosis: "Everyone reading this has built that flow. It isn't a bad flow. It's a trapped one." The trap isn't a scripting failure. It's an architectural one: to handle that call with a script, you'd have to predict every path in advance, and the effort curve goes vertical long before the conversation gets genuinely complex.
Last week this newsletter looked at how AI is reshaping identity and roles inside design teams. This week the object of study is narrower and harder: the actual design pattern at the center of every agent product, and the discipline now hardening around it.
That discipline has a name—Agentic User Experience, AUX—and a canonical shape. The reference site auxfirst.com reportedly defines it as "the discipline of designing how people delegate to AI agents over time," and its load-bearing artifact is the autonomy spectrum.
Five stages. Suggest: the agent proposes, you do the work. Draft: it produces work you review before anything leaves. Act-with-confirm: it's ready to go but waits for explicit approval. Act-and-notify: it acts alone, then tells you. Autonomous: it acts, surfacing only exceptions.
The governing rule is elegant: "Trust should move a system rightward along this spectrum; consequence should move it leftward." It's the kind of clean abstraction that spreads fast—and similar ideas can be found, though not necessarily derived from it, in Victor Yocco's forthcoming book, which reportedly describes a practical framework for building AI partners that users trust, and in Amazon Science's independently developed coordination framework, alongside conference talks and reference guides.
And it flatters everyone who touches it. For a vendor, "we're moving customers rightward" is a roadmap. For a designer, calibration becomes a dial you turn as trust accrues. The metaphor makes autonomy feel like a volume knob with a moral: earn trust, turn it up.
Here is the problem. The one live, in-production proof point in front of us doesn't work by turning a dial rightward at all. It works by carving territory out of the dial's reach entirely.
Look at how Five9 actually built the thing that fixes the trapped call. The headline move is the multi-agent orchestrator, in production today, that reads intent and re-routes mid-call when the caller jumps. That's the part that lets the agent re-plan instead of breaking when the dog barks and the subject changes.
But the load-bearing design decision sits one layer down, in what Five9 calls the Tools Server. And it is the exact opposite of "more autonomy."
The Tools Server, they write, "isn't just 'the agent makes an API call.'" It's where you sculpt the deterministic parts of a workflow—"the steps that must always happen the same way, in the same order, regardless of what the model decides in the moment."
Their example is precise. When a ticket is raised, a confirmation email must follow. That's a business rule, not a judgment call. So rather than ask the language model to reason about and fire each call separately, you chain them: create_ticket → send_email runs as a single reliable unit.
The principle, stated in one line: "The agent decides what needs to happen; the Tools Server guarantees how." Keep the model out of the steps that don't need reasoning, and the whole system gets faster, cheaper, and more predictable.
Read that against the spectrum. In the AUX framing, a mature agent has climbed rightward—it acts, it notifies, it handles the exceptions. More autonomy is the reward for accrued trust.
But Five9's most trusted, most production-hardened behavior isn't the agent acting freely. It's the agent being structurally forbidden from deciding whether the confirmation email goes out. The reliability comes from removing that step from the model's judgment, permanently, by design.
That's not a point on a slider. That's a wall.
The distinction matters because the two pictures teach opposite lessons. The spectrum teaches: as trust grows, expand the agent's discretion. The Tools Server teaches: as stakes clarify, contract the agent's discretion—lock the deterministic steps into rails the model cannot touch.
Notice these aren't even in conflict inside Five9's own system. The orchestrator gets more freedom to reason about paths, while the Tools Server gets more steps locked away from reasoning. Autonomy went up and down at the same time, on different axes.
That's the tell. "More autonomy" is not a single quantity you can push in one direction. What Five9 shipped is better described as more tightly bounded autonomy: the agent's room to reason widened precisely because the consequences of its reasoning were fenced.
To be fair, the AUX framework isn't blind to consequence. Its own rule says consequence moves a system leftward, and it gestures at an "Action Heat Ladder" for scoring which actions belong where. Amazon Science, likewise, names the failure modes—an agent that feels "too absent, too intrusive, or appropriately calibrated."
But the geometry gives the game away. When you model the design space as a single left-right axis, leftward and rightward are the only two moves available. You can slide, and that's it.
The Tools Server is not a slide. It's a different operation entirely—removing a step from the axis, so it can never be a matter of the agent's confidence, its trust score, or its momentary judgment. The durable design work isn't choosing a position on the line. It's deciding which decisions never get to be on the line at all.
The durable design work isn't choosing a position on the line. It's deciding which decisions never get to be on the line at all.
Call it what it is: a boundary, architected, not a dial, turned.
This is where the timing gets uncomfortable. A discipline is formalizing itself right now. There's separately, a book from Victor Yocco shipping in August 2026, conference proceedings out of Beijing on AI-enabled creative design, a reference site publishing its "pillar" guides, and leaders at Accor and Atlassian and Expedia quoted by Figma—though the evidence shows no direct connection tying these into a single shared canon.
Accor's Thomas Vidal actually said the right thing: "our goal is not to ensure that we design what AI can do, but to create the conditions and the rules for the system to behave consistently." That's boundary thinking. That's the Tools Server in a sentence.
But it sits in the same issue as "increasingly autonomous control over workflows"—the rightward-march language that the spectrum keeps reinforcing.
The risk isn't that the spectrum is useless. It's a fine vocabulary for describing supervision levels once your boundaries are already set. The risk is sequencing.
If we codify the dial before we codify the boundary, we teach a generation of designers that their central craft is calibrating trust along a line—when the shipping evidence says the central craft is deciding what to wall off from judgment entirely, and guaranteeing how it runs.
That's a harder skill. It requires knowing your domain well enough to say: this step is a rule, not a reasoning problem, and it always will be. It's less flattering than a trust journey. It doesn't come with a satisfying rightward arc.
But it's the thing that actually got the woman with the college-bound daughter out of the 23-minute hold. Not because the agent was trusted more. Because the system was bounded better.
Codify that first.