There is a moment in many agent conversations when another paragraph is the wrong answer. The person may need to choose a date, compare two options, approve a change, or inspect a few records. A small form or confirmation card would make the job obvious. A2UI is a way to let an agent ask for that kind of interface without handing the model the keys to the application.

The agent asks; the product decides how it looks

An agent can describe the pieces it needs: a heading, a short summary, a list, a date field, or an approval action. The host application maps that description to components it already trusts. The agent is not sending a finished webpage and it is not allowed to ship JavaScript along with the answer.

That arrangement is useful for more than security. The product team can improve the date picker, accessibility, or mobile layout in one place. The model does not need to learn the redesign. It simply continues asking for a date picker when the workflow requires one.

Do not let a label become a permission

Every component request still needs validation. Limit the types of components, the amount of text, the size of a list, and the destinations a link can reach. Treat labels and values as untrusted data. A button that says “Approve refund” is only a visual suggestion until the server checks the person, the order, the amount, and the current state of the case.

Design for the awkward moments

Real work includes missing information, slow tools, empty results, and an agent that is not sure. A useful screen can show what was found, what is uncertain, and what the person can do next. It should also be comfortable saying that a request failed instead of displaying a polished form that no longer matches the data.

Keep the layers honest

A2UI is the presentation layer. Agent-to-agent messaging can carry a task, and a tool protocol can expose a controlled operation, but the interface must not replace authentication or authorization. Test the boring cases as well as the clever demo: malformed component data, unsafe links, an oversized response, and a user who does not have permission to take the proposed action.