Watch any AI agent demo and you will see the same thirty seconds.
Someone types a wish into a box. The screen fills with activity. A pull request appears, an email goes out, a spreadsheet reconciles itself. The person filming says and I didn’t touch anything.
That sentence is the whole pitch. It is also the exact thing the buyer is afraid of.
The thing you are proudest of is the thing they are scared of
Builders are proud of autonomy because autonomy is the hard part. Getting a model to plan, pick a tool, read the result and recover from a mistake is genuinely difficult, and when it works it feels like magic.
So the demo shows the magic.
But the person who has to approve the purchase is not watching a magic trick. They are watching software they do not control touch a system they are accountable for. Every second of untouched autonomy in that video is a second of unaddressed risk in their head.
The demo is optimised for the feeling of the builder. The purchase is blocked by the feeling of the buyer. These are not the same feeling, and in this category they point in opposite directions.
Nobody is selling the boundary
Go and look at how agent products describe themselves. You will find, in almost every case:
- what it can do
- how many tools it connects to
- how fast it is
- a testimonial from a delighted developer
You will very rarely find, stated plainly on the page:
- what it cannot touch
- which actions stop and wait for a person
- what happens when it fails halfway
- what is written down afterwards
The second list is not marketing material. It reads like a limitation document. Which is exactly why it works — everyone already assumes the agent sometimes does something stupid. Saying so, precisely, is the only way to be believed about anything else.
There is a version of this that is a cheap trick, and it is worth naming so you do not do it. Writing “enterprise-grade security” on a page is not a boundary. A boundary is a list of specific actions with specific names that specific people have to approve. If it does not cost you anything to say, it does not buy you anything either.
I have made the mistake in the other direction
Eighteen months ago I built a template, put a pricing page on it, and waited. It sold once. I wrote about that already, and the lesson I drew at the time was about distribution.
But there was a second lesson underneath it that took me longer to see.
I had built the thing I found interesting and assumed the buyer found the same thing interesting. I was wrong in the small way then, and the whole agent category is wrong in the same way now, just louder.
What this looks like when you build it
I have been putting this into an Astro template for AI agent products, called Astroloop. Two sections carry the argument, and both of them are things I could not find on any other template.
The first is a diagram of the loop, with the arrow that goes back to planning and the gate that stops before the result and waits for a person. Most product pages draw a one-way arrow with three steps on it. The loop and the gate are the two elements that answer what actually happens when nobody is watching, and straightening them out to look tidier throws away the argument.
The second is a permission matrix. One row per tool, four columns: what it reads, what it writes, what it has to ask about first, and whether it is audited.
Two details in that table matter more than the table.
Writes and approval are separate columns. Buyers are not afraid an agent can write. They are afraid it can write without asking. Merge those columns to save space and the whole thing stops meaning anything.
Some cells are empty. In the sample data, the database row has no write access and the email row has no read access. A column of green ticks reads as a feature list. Blanks read as a real permission audit, because a real one always has holes in it.
It is MIT, it is free, and the demo scores 100 on Lighthouse — that last part matters here only because a page arguing for restraint should not itself ship two megabytes of JavaScript.
The general form
This is not really about agents.
Any time you are selling something that takes control away from someone, the feature you are proudest of is the objection you have to answer. Self-driving, automated trading, automated hiring, anything that acts on its own behalf inside somebody else’s business.
The builder wants to show what it does alone. The buyer wants to know where alone stops.
Most people in the category are answering the first question louder and louder. The second one is still sitting there, unanswered, and it is the one holding the money.