Choosing software when an agent is supposed to operate it

You are sitting in the demo. The salesperson clicks through the interface, it all looks good, the price is right. One question never comes up in that meeting — and it is the one that costs the most later.

The past few weeks brought an unusual number of software decisions: password manager, Git hosting, newsletter system, analytics, mail delivery, identity management. In every single one, the same question came first — before price, before the feature list, before the design:

Can an AI agent operate this tool completely from the outside?

Part 4 made the case: an agent is only as useful as the surfaces it can operate. This part turns that into a working tool — the concrete checklist, with real outcomes of real decisions.

The five test questions

1. Is there an API for everything the UI can do? The decisive distinction is “has an API” versus “is API-first”. The former often means: a retrofitted endpoint can do three things, the web UI can do thirty. API-first means: the UI is itself just a client of the API — everything clickable is also callable. The test takes ten minutes: take the three admin tasks you perform most often and look them up in the API documentation. If one is missing, it will remain manual work forever.

2. Is there a command line? For an agent, a good CLI is often worth more than an API — no token management, no HTTP error handling, directly usable. Our password manager decision was made exactly here: the long-standing, comfortable provider had no CLI and no usable API. For a human, a comfort loss of zero — for an agent, the tool is simply invisible. It can fetch no secret, store none, verify nothing. The successor (Vaultwarden) is operated entirely through the command line.

3. Is the configuration text? Settings that live only in a database or behind click paths are settings an agent can neither version nor trace nor restore. Configuration as a file means: Git knows every change, a new server is a replay of the files, and the agent reads the truth instead of guessing it. That was a main reason for our self-hosted Git (Forgejo) and against managed alternatives.

4. Can you get at the data — completely, at any time, machine-readable? The exit test: could I get all my data out tonight, in an open format, by script? Whoever hesitates here is selling lock-in as a product. For the newsletter system this was a first-order knockout criterion — the subscriber list is property, not a rental.

5. Does it run where I control it? Not everything has to be self-hosted. But everything has to be controllable: your own infrastructure, your own region, your own contract. For tools that see customer data, this is not a matter of taste for Swiss companies.

Three real scorecards

Analytics: the market leader has APIs in abundance — but test question 5 buries it (data at the advertising corporation), and the consent requirement right along with it. The self-hosted counting (Privacy part 2) passes all five; the agent fetches the numbers itself every morning.

Git hosting: cloud providers pass 1–4 without trouble. What tipped the scales was 5, combined with the costs of growing teams — and the experience that our own instance can be fully managed by the agent via API: mirrors, access, backups, all scripted.

Mail delivery: here the value of test question 1 showed in detail: verifying domains, rotating credentials, reading delivery logs — all possible via API. The agent handled the complete setup including DNS records on its own; a tool without these surfaces would have meant hours of click work, repeated with every change.

The truth about cost

The objection is obvious: API-first tools are often the more spartan ones, and self-hosting costs operations. Both true. The counter-math: every tool an agent cannot operate becomes an island of manual work in an increasingly automated chain — and manual work does not scale, it repeats. With every click-bound tool you are buying the limits of tomorrow’s automation.

That is why the checklist is not a technology question but a procurement policy: what the agent cannot operate does not get bought — unless you want it deliberately. Deliberate exceptions exist; LinkedIn, for one, passes not a single test question and gets used anyway, because that is where the customers are. But it is a documented exception, not a creeping default.

The question for your next purchase: would the demo work without a mouse?

Part 7 of “Own Your Stack”. On Sunday, the Sonntagsausgabe settles the bill: six weeks of rebuilding in Swiss francs, hours, and failures.