Your API returns a timeout. A human pauses, checks state, and decides whether to try again. An autonomous agent may retry immediately, use every permission it has, and keep going long after the original assumption stopped being true.

Many APIs were designed with a human somewhere near the loop—someone who can interpret an ambiguous error, notice an unexpected result, or stop the workflow. Agent callers turn those assumptions into architecture risks.

This session shows how to redesign an existing API boundary for autonomous callers. A before-and-after walkthrough will add idempotency keys and operation status for unknown outcomes, rate and cost budgets for retries, least-privilege scopes for bounded actions, structured errors with recoverable next steps, and traces that connect model decisions to API effects. We will also separate actions that can run unattended from those that require approval or revalidation.

Attendees will leave able to identify human-in-the-loop assumptions hidden in REST and RPC APIs, contain the blast radius of agent mistakes, design retries that do not duplicate irreversible work, scope permissions around actions instead of broad roles, and audit an API for agent readiness.

No agent framework is required. The goal is an API that stays predictable whether the caller is a person, a script, or an autonomous workflow.

Audience: mid-to-senior engineers and architects. Tracks: Architecture, Software Quality, AI Agents & Workflows. Format: adaptable to 30, 45, or 60 minutes with a before-and-after API walkthrough. Vendor-neutral.