Last night, twelve AI agents restyled about half of our aviation operations product. Calendars were rebuilt, dashboards torn down and reassembled, whole list surfaces replaced with a denser grammar borrowed from air traffic control flight strips. It was the fastest UI iteration I've ever been part of, by a wide margin.
Here's the strange part: nothing about the product's judgment broke. Not one release gate passed a flight it shouldn't have. Not one compliance check changed its mind about what the regulations require. The software that decides whether an airplane is legal to fly was untouched by the most chaotic thirty-six hours in the product's life.
That wasn't luck. It was architecture, and I suspect more software will want something like it in the agent era.
Two layers, two speeds
Our product is built on a platform where the domain lives in a formal spec: every entity, every state machine, every guard that blocks a transition, every derived field. The kernel interprets that spec at runtime. When a charter leg tries to move to released, the spec says which checks stand in the way, and the kernel evaluates them against real records. No UI code gets a vote.
The original thesis was that the spec would render the interface too. Define the domain once, get the screens for free. We built that renderer. It works. And it lost, decisively, to hand-written React built against design screenshots, because generated interfaces are legible the way a form is legible, and operators deserve interfaces that are legible the way a cockpit is legible. Somebody has to make calls about density and hierarchy and what a maintenance strip should say when the airplane is in the shop. Those are taste calls. Specs don't have taste.
So the thesis quietly inverted, and the inverted version is the one that works: the spec governs behavior, the interface is craft, and the boundary between them is the most valuable line in the codebase.
Presentation now moves at whatever speed we can review it, because the worst a bad interface change can do is look wrong. Behavior moves slowly and deliberately, through spec migrations with tests, because the worst a bad behavior change can do is lie about the law.
Why agents make this urgent
If humans wrote all your code, this separation would be good hygiene. With agents writing most of it, it becomes the load-bearing wall.
An agent iterating on your UI at 2 AM will make mistakes. The only question is what its mistakes are able to reach. When the legality of a flight release lives in a spec the UI can only read, an agent's worst night costs you some ugly screens. When that judgment is smeared through the view layer, the same night can cost you a compliance system that silently agrees with whatever the screen happens to show.
There's a subtler benefit too. Agents are good at exactly the thing formal specs provide: a machine-legible statement of what the system means. Our agents could refactor confidently because they could always ask the spec what was true, instead of inferring it from whichever component they happened to be editing. The spec is documentation that can't drift, because it's also the implementation.
Where the seams show
I'll be honest about where this architecture bites, because the failure modes are instructive.
Every place our business code restated spec knowledge instead of reading it, we grew a trap. This week we found three files that had copied a list of crew currency requirements as string literals. Remove the values from the spec without rewriting those copies and a release guard becomes permanently unsatisfiable: it demands a credential that can no longer exist, and every flight blocks, forever, with no error pointing at the cause. The spec can't lie, but code that paraphrases the spec can.
Same disease, softer symptom: interface code that reinterprets spec verdicts in prose. We found four separate surfaces each translating the same guard result into slightly different English, and one of them was wrong. The fix each time was the same: derive once, share everywhere. The general rule I've landed on is that anything downstream of the spec should be generated from it or should import it, never restate it. Restatement is where drift lives.
The portable lesson
Strip away the aviation specifics and I think this generalizes, though I'll only claim it worked for us. The thing I'd take from it: find the layer of your system that isn't allowed to lie, formalize it until machines can read it, and let everything above it move at the speed of taste.
I had this backwards for a long time. When the prose, the pixels, and the copy are tangled up with the judgment layer, every change is dangerous, and the whole thing moves at the speed of fear. Pulling them apart is what let a dozen agents and one very tired human rebuild a product's face overnight while its conscience never flickered.
The face should be easy to change. The conscience shouldn't. That's the line I'm building on now.
Continued in The Layer That Remembers Why: giving the speed-of-taste layer a memory of why it looks the way it does.