Your Next Customer Might Send an Agent. Most Businesses Will Turn It Away.

For twenty-seven years the deal has not changed. A human finds your business, a human fills out your form, a human becomes your customer. Every signup flow, every request a quote, every newsletter box quietly assumes the same thing: a person on the other end, with a mouse and a little patience.

That assumption is breaking, and faster than most owners realize.

The Front Door Is Changing¶

People now run AI agents that do real work for them — book the travel, clear the inbox, chase the follow-ups. Those agents are starting to show up at the front door of businesses and try to sign up on their owner’s behalf. The agent is not the customer. The agent is the customer’s staff. And it is the one knocking now.

This is not a 2030 problem. The plumbing shipped this spring.

Most Businesses Will Get This Exactly Wrong¶

There are two predictable reactions, and both lose customers.

The first is to treat agent traffic as bot traffic and block it. Feels safe. What you actually did was slam the door on a customer who was ready to convert.

The second is to leave the form exactly as it is and let the agent fight through it — the captcha, the four-step wizard, the email verification that breaks on anything but a human in a browser. The agent gives up. So does the person behind it.

The instinct in both cases is to defend the form. But the form was never the point. The account on the other side of it was the point. We have spent two decades optimizing a piece of friction we should have been planning to remove.

What Agent-Ready Actually Means¶

A protocol called auth.md shipped this spring — published by WorkOS, with Cloudflare and Firecrawl among the first to adopt it. Strip out the jargon and it is simple: your site publishes a small file that says here is how an agent may register a user with me. The agent reads it, requests the account, and then — this is the part that matters — the human gets a one-time code and confirms. No account exists until a person says yes.

So the customer never fills out a form, the agent handles the busywork, and consent stays exactly where it belongs: with the human. That is the whole game. Remove the friction, keep the trust.

I Am Telling You This as a Builder, Not a Pundit¶

I do not write about shifts I have not built through. So this week I built the thing.

NoForm makes any app agent-sign-up-able over auth.md, and as of today the skill that lets the largest open agent ecosystem do it is live. You can watch an agent run the real signup at noform.dev, and you can see precisely how the human stays in control of it:

That is not a mockup. The agent completes a real registration, and the human approves it with a real one-time code. I shipped it because the fastest way to understand where the front door is going is to build the new one and stand in it.

What This Means for Your Business¶

You do not need to become a protocol expert. You need to make the same kind of decision you made when you put up a website in 1999, or made it work on a phone in 2012: get ahead of where your customers are going, or spend the next five years catching up to it.

Every platform I build for a client gets built with that instinct already in it — own the system instead of renting five disconnected ones, stay provider-agnostic so you are never hostage to one vendor, and make the front door work for whoever, or whatever, arrives at it. Agent-ready signup is not a feature you bolt on after the fact. It is a decision about whether the thing you are building is built for the next decade or the last one.

The Builder’s Bet¶

The businesses that win the agent era will not be the ones with the flashiest AI. They will be the ones whose front door an agent can actually walk through — cleanly, safely, with the human still holding the keys. That is a build, not a plugin. It is the kind of thing I do.

If you want to talk about what agent-ready looks like for your business — 30 minutes, no pitch — my contact page is open.