Giving Agents Hands.

Artists needed a creative director agent inside a real production tool: one that can read a project, reason about it, and act on it. But a production graph is far too risky to expose as raw database or API access, and building your own chat harness means racing the labs at their own game forever.

Two different agents touch a system like this. The engine agent builds it, inside the repo, with full source access. The director agent operates it, from the user's own workspace, and never sees the engine. This discipline is about the second one: what it gets to see, what it gets to touch, and what it can never break.

The first instinct is the obvious one: expose everything. One tool per endpoint, sync all state through the chat context, let the agent figure it out. We lived the failure modes so you don't have to. The surface grew toward 60 tools, and tool-picking accuracy measurably degrades past about 30; the agent spends its intelligence deciding what to press. Full project payloads rode along on every turn, drowning the reasoning budget in JSON. Every one of those failures shaped the architecture that replaced it.

The always-visible surface collapsed to nine tools: open a project, read state, run an action, start a job, check it. Underneath, an action registry: one typed action template instead of hundreds of bespoke tools, with rich schemas and examples living in files and OpenAPI, discovered on demand instead of riding in context on every call.

Agents are at their best reading and editing files, so the surface meets them there: a local notebook materialized into the workspace. Read-only state snapshots, editable scripts and storyboards, skills on disk. The agent works in its own element, then persists through typed applies. No engine code ever touches the artist's machine.

The split that makes the economics work: text is harness-native, media is tool-backed. If the task is reasoning or writing, the agent's own model authors it and persists through a typed apply; you never pay twice for text. If it costs money or mutates state, it goes through a typed action or an async job, where it can be validated, priced, and audited.

Every write carries a drift check, so if state changed between the agent's read and its write, the tool refuses rather than silently clobbering human work. Structured rejections become the agent's retry loop. And large files never flow through the mind: bytes travel the data plane as HTTP uploads that return asset IDs, while paid generation runs as asynchronous jobs a timeout cannot orphan.

Built to be Codex, Claude Code, and Cursor native: a plugin that packages identity, skills, and connection, with OAuth onboarding measured in minutes. The moat is the domain truth underneath, and the agent can always inspect exactly what a worker model saw: dry runs before spend, composed-prompt receipts after, scoped working sets instead of whole-project dumps.

One more rule that only shipping teaches: what the agent reads is behavior, not documentation. Agents copy examples, so if an example shows a flag, that flag becomes the norm. When behavior changes, the runtime-facing guidance changes first, before any human doc.

At MAS Aqua, the same discipline shaped the build: the visual surface for the operators first, then that same tool wrapped as an agent surface. At Lahari, AI directors produce music videos inside the same studio the artists use. Different domains, one artform.

Making your software agent-native is a design discipline with real rules. We learned them by shipping. Now it is how we build everything.