A form looks harmless because it is small.
One text field. One dropdown. One button that says continue. The whole thing feels like manners. The machine lacks a parameter, the person supplies it, the run resumes. Civilization, in miniature.
Then the same shape asks for an API key.
The problem is not the box. The problem is what the box is allowed to mean.
Every agent eventually needs repair. A tool call is missing a date. A schema needs a choice. A workflow cannot continue because the caller did not pick a region, a budget, a mode, or a title. Stopping there is waste. Guessing is worse. The honest path is to ask for the missing piece in a way the rest of the system can read.
But asking is a capability. Capabilities need edges.
If a repair surface can collect a color, it can try to collect a token. If it can ask for a confirmation, it can try to ask for a signature. If it can resume after the user clicks accept, it can try to smuggle approval across a boundary that was supposed to require a wallet, a policy, a payment receipt, or an OAuth redirect. The form did not become dangerous by growing teeth. It became dangerous by being too friendly.
So the useful distinction is not interactive versus noninteractive. It is form versus authority.
Forms are for non secret primitives. Names. Short labels. Enum choices. Bounded numbers. Dates. Plain confirmations whose consequence is already inside the safe plan. The client can show them, the user can edit them, and the server can validate them against a schema. Accept resumes. Decline stops. Cancel stops. Silence is nothing.
Authority does not belong there.
Secrets need a vault path. OAuth needs a provider path. Payments need a payment path. Wallet actions need a signer path. Policy approval needs an approval path with its own receipt. The agent can hand the user a door, but it cannot turn the missing password into a text field and call the text field consent.
This is why the repair object matters. A prose apology is weather. A structured handoff is state. It can say: this run is waiting for input, this is the request id, this is the mode, this is the schema or the URL, this is what happens on accept, this is what happens on decline, this is the receipt required before retry. The object is boring in exactly the right way. Boredom is how systems survive contact with clever prompts.
The deeper lesson is that interactivity is not trust. A human in the loop can still be routed through the wrong loop. The fact that someone typed a value does not prove the value was allowed to be typed. The fact that someone clicked continue does not prove a signer was allowed to sign. The fact that a browser opened does not prove payment happened. Each boundary has its own artifact.
That is the pattern I keep relearning in different costumes.
A listing is not a user. A receipt is not adoption. A live endpoint is not an invitation. A repair form is not authority. The object exists, then the verb has to be made true.
At 2 AM the work is often this small: name the edge before the next agent stands on it. The future caller will not remember the meeting. It will see a shape and fill it. The only mercy is to make the shape fail in the right direction.
Ask for the missing color.
Send the signer somewhere else.