Three Surfaces, One Architecture

The call was supposed to be about our product. We were collecting feedback on Bryn, and for the first few minutes it went the way feedback calls go. Then the founder on the other side, a person who has spent about twenty years building marketing software, stopped answering our questions and started describing an architecture. His architecture, for his product, in his market.

It was ours. Not adjacent to ours, not rhyming with ours. The same three surfaces, the same reason they exist, and the same mechanism for staying in control once you let an agent act. Nobody led him there. That is what this note is about.

The three surfaces

In his framing, software you sell no longer lives in one place. It lives on three surfaces at once.

Surface one is the tool's UI. The screens. The place a human logs in, looks around, configures things, and decides. Every product has this surface; for twenty years it was the only surface that existed.

Surface two is the agent inside the tool. The product stops waiting for clicks and starts doing the work itself: watching, drafting, executing, within whatever bounds the operator set. Same product, different operator.

Surface three is the agent outside the tool. This is the one most roadmaps miss: the agent the customer brings, reaching into your product over MCP. Your product stops being a destination and becomes a set of capabilities somebody else's agent can call.

He is building on all three. So are we.

Two teams, one shape

One company describing this model is marketing. You should discount it accordingly, including when the company is us.

Two companies building it independently is something else. We operate in unrelated markets, sell to different buyers, and got here by different roads. Neither of us had seen the other's roadmap. And the shape that came out is the same, down to the ordering of the surfaces and the thing that holds them together.

Independent convergence is the strongest signal a thesis gets before the market votes. When separated teams keep landing on the same structure, the structure is probably not a preference. It is probably what the constraints demand.

The argument he assembled himself

The part that made us sit still was not the surfaces. It was that he reconstructed, unprompted, the exact problem our audit record exists to solve, and then the solution.

His chain went like this. Deterministic software is too limited: rules only handle what the rule writer foresaw. So you want the agent to do the work: that is the whole point of hiring one. But once the agent does the work, you lose visibility: the work now happens where you are not looking. So you need a record of what the agent did, because the record is how you "check on the agent" and steer it without standing over it.

He named the problem the record solves before anyone on our side explained it. We have written before about how Bryn answers the three questions every operator eventually asks an agent; he arrived at the questions on his own, from his own product, in his own market.

The on-ramp

One more observation from the call, and it matters for anyone shipping on these surfaces: most users are not ready for the agent surfaces on day one.

They start on surface one. They click around, they build trust, and then they cross over, first letting the agent inside the tool carry work, later wiring their own agent in from outside. The surfaces are sequential for most people and parallel only for the early crowd. Which means public copy has to work for people who are not there yet, without lying to the people who are.

The same three surfaces, running

Bryn is the governed execution layer that runs Plays through your stack, and it runs on exactly these three surfaces today.

Surface one is the control plane: the UI where the growth owner defines Plays, approves them, and reads runs. Surface two is Bryn acting inside the product on approved Plays, doing the work while the moment is still a moment; Wednesday's note took one apart frame by frame. Surface three is MCP access for the customer's own agent: the same signals, scores, and runs, reachable by whatever agent your team already operates.

And the record is the spine across all three. Every run writes its receipts as it works, and the same run is inspectable from the UI, from inside the product, and from the customer's own agent. Three surfaces, one set of proof.

Surface 1, the tool's UI. Operated by the human: the growth owner. For configuration, review, and decisions: define the Plays, approve them, read the runs. Governed by permissions and the operator's own eyes. In Bryn, this is the control plane.

Surface 2, the agent inside the tool. Operated by the product's own agent: Bryn, acting on approved Plays. For doing the work while the signal is warm. Governed by the Play definition the operator approved, and the per-run record.

Surface 3, the agent outside, over MCP. Operated by the customer's own agent, whatever the team already runs. For reaching in: the same signals, scores, and runs, through governed tools. Governed by the same permissions and the same record as everything else.

The record is the spine across all three: the same run, inspectable from every surface.

Select a surface, or use arrow keys. Three operators, one record.

Map your stack

The do-it-Monday version. Take the tools you pay for and put each one on the map: which surface does it actually live on, who operates it there, and what checks the agent when it acts?

Two readings fall out fast. A tool that lives only on surface one is a dashboard, whatever its landing page says. And anything acting on surface two or three without a record is a liability, because you have granted the work and kept none of the visibility.

The three surfaces are where software is going. The record is how you go there without losing the steering wheel. We believed that before the call. We believe it more now that someone else built the same thing for different reasons.

Bryn starts at $49 a month with a 7-day trial. Pricing is public at civic.com/bryn/pricing.

---

Further reading

• Anatomy of a Moment (Civic Field Notes): one signal, taken apart frame by frame, and what runs while it is warm.
• How Bryn Answers the Three Questions (Civic Field Notes): the three questions every operator eventually asks an agent.
• Proof of Claims (Civic Field Notes): why receipts, not promises, are the unit of trust.