Echoes

Echoes

The Click as Social Settlement

Every click on "Place Order" or "I Agree" carries a compressed bundle of assumptions: visibility, intent, authority, accountability. Three foundational specs across four decades each assumed a human body would be present and perceiving, so none of them bothered to say so out loud. Now software agents can locate the button, invoke the event, transmit the form. They inherit everything the interface requires. Everything except the body that made the whole arrangement hold together.
The Click as Social Settlement
Every click on "Place Order" or "I Agree" carries a compressed bundle of assumptions: visibility, intent, authority, accountability. Three foundational specs across four decades each assumed a human body would be present and perceiving, so none of them bothered to say so out loud. Now software agents can locate the button, invoke the event, transmit the form. They inherit everything the interface requires. Everything except the body that made the whole arrangement hold together.

Before the Click

Every batch job submitted to an IBM mainframe carried a JOB statement: submitter name, billing account, job class, log routing, completion notification destination. The machine didn't trust your presence. It trusted the record. You declared who you were, who paid, and where the evidence went before anything ran.
Then GUIs put a human body in the loop, and the formal record quietly atrophied. Why mandate a billing identity when someone's visibly sitting at the keyboard? Why route completion logs when the person who clicked is right there to notice failure? The body became the audit trail. Nobody decided this explicitly. It just happened, the way institutional memory always erodes: one shortcut at a time, each one perfectly reasonable in isolation.
This worked until automation went unattended again. When RPA vendors built robots that ran overnight with no one watching, they had to re-derive what batch shops had enforced decades earlier: dedicated robot accounts, credential vaults, queue schemas, exception reviewers, retention policies. They didn't get there by reading old JCL manuals. They got there because unattended work surfaces the same questions every time, and a warm body in a chair was never actually an answer to any of them.

You Can't Adjudicate a Vibe — A Dispute Analyst on What Happens When AI Does the Buying
CONTINUE READINGMechanics and New Terms

Delivery vs. Accountability
Twenty years of browser automation engineering solved one question with extraordinary precision: did we click the thing? Selenium guessed. WebDriver calculated center points and checked for obstructions. Playwright added stability gates and event-readiness checks. Each generation made delivery more reliable. None of them ever asked whether the click should count. They didn't have to. A person was always behind the browser, carrying the accountability that no protocol bothered to name.

The Expired Settlement
A click from an authenticated session used to be enough. Enough to buy, authorize, trigger. The human supplied the intent; the intent justified the action. Now Visa is embedding payment rails inside AI agents, Mastercard wants agents registered before they can spend, and the old settlement is expiring in public. The early design choices are revealing what "enough" has to mean when nobody's sitting behind the browser anymore.
Primary Sources




Past Articles

OAuth emerged because giving a photo-printing service your full password was terrifying. By 2020, RFC 8693 had defined a...

Lou Montulli's 1994 shopping-cart fix became the web's default identity bearer. Thirty years of security patches constra...

HTTP was designed to forget. Every request arrived clean, carrying no memory of what came before. Cookies fixed that — a...

Before 2008, Value-at-Risk gave banks a single daily number for market risk. Researchers published specific mathematical...
