People treat a click like plumbing. Finger hits button, signal fires, thing happens. But if you actually sit with what's packed into the moment someone clicks "Place Order" or "I Agree," you start pulling on a thread that goes back forty years through layers of assumption that nobody ever bothered to write down. And the question that matters right now, as software agents start clicking on our behalf, is whether those assumptions were ever the click's to carry.
Start where the thread probably starts: the Xerox Star. When Johnson et al. wrote their 1989 retrospective on the direct-manipulation model, they grounded the whole thing in a specific physical setup. A user who could see system state on the display, recognize familiar objects, and point at them. "Seeing and pointing over remembering and typing." Nothing happened behind the user's back. The user could understand the system by looking at it. The click was just the visible tip of a perceptual arrangement where the person doing the gesture and the person doing the understanding were the same body. Nobody specified that relationship because nobody had to. It was load-bearing in the way a foundation is load-bearing: invisible until it shifts.
That assumption probably traveled a lot further than anyone intended. RFC 1866 defined the HTML form model in 1995. Fields, values, encoding, the distinction between GET and POST, the action URI. It even covered password input types. What it did not define (and I went looking, because I wanted to be wrong about this) was anything about the submitter's authorization, identity, or institutional authority to submit the form. The spec nailed down the mechanics of transmission and left the question of who's transmitting completely unaddressed. The body was still assumed to be there. That part was someone else's problem.
The DOM Level 1 specification drew one more quiet boundary. It gave programmers a standard API for manipulating document structure and explicitly declined to define what it called the "true inner semantics" of the documents it exposed. Where the button lives in the tree, yes. What pressing it means, no.
Three specs, all silent on the same thing. And by the time they'd hardened into the platform we all build on today, the click had become the load-bearing joint for things none of them individually defined: visibility, intent, authority, accountability. A whole compressed settlement resting on one premise that never got written down:
Someone who can see the screen. Someone who chose this action over the alternatives. Someone who can be held responsible afterward.
A human body, present and perceiving and accountable. The settlement held because the body was always there. Nobody spec'd the dependency because it had never once been absent.
So when an agent clicks, it inherits the interface. It can locate the button, invoke the event, transmit the form. It can do everything the settlement's machinery requires. What it does not inherit is the body that made the settlement cohere. Not the seeing, not the choosing, not the being-held-responsible. The click still fires. The form still submits. But the bundle of assumptions that gave the gesture its social weight has been quietly hollowed out, and nothing in the stack ever made those assumptions explicit enough to verify whether they still hold.
Nobody removed the assumptions. They just stopped being true.
- Delegation already has vocabulary: RFC 8693's OAuth 2.0 Token Exchange defines an
actclaim that can express that authority was delegated and identify the acting party, distinguishing delegation from impersonation. - Payments can't pretend: The AP reported that Visa's integration with ChatGPT includes spending limits, required approvals, and dispute-handling rules designed around the question of whether agent-initiated purchases reflect genuine consumer intent.
- RPA built the furniture first: UiPath's documentation distinguishes attended from unattended robots and requires robot accounts, credential assets, queue-based exception handling, and searchable audit logs before trusting automated work at scale.
- The mechanical click alone is hard: The W3C WebDriver specification defines the Element Click command as a sequence that must scroll into view, target the center point, and error on obscured elements, a reminder of how much engineering sits behind even the delivery side of a click.