On June 18, 2026, LatePost got hold of an internal all-hands memo from DingTalk. The sender was CEO Chen Yusen. Most of the memo covered organizational changes, but one directive near the end is easy to gloss over: “Establish the Corporate Information Technology Department, responsible for optimizing and iterating the company’s business systems, making all systems easy to use by Agents. Deng Wu is in charge, reporting to me.”
Making all systems easy to use by Agents. This sentence was written directly into the KPI of a department that reports to the CEO. Yicai, Jiemian, IT Home, Phoenix Tech, 36Kr, and LatePost cross-verified the original text. It came from an internal memo, not a PR release — no cushion of marketing language. Among domestic Chinese enterprise software vendors, this is the first time agent-friendly has been written into a department charter with a reporting line.
Less than a month earlier, Salesforce launched Headless 360 at its TDX developer conference. EVP Jayesh Govindarjan’s words were strikingly similar to what Chen Hang would say: “don’t hide functionality behind UI, expose it so the entire platform can be programmed from anywhere” (Phoenix Tech report). Salesforce broke down every capability on the platform into API endpoints, MCP tools, or CLI commands — over a hundred new tools. External coding agents gained real-time access to the full Salesforce environment for the first time.
ServiceNow and Snowflake are both remodeling in the same direction, each with different emphases. ServiceNow fully launched Action Fabric in May 2026, recomposing its Skills, Workflow, and Knowledge Graph into MCP tools, declaring it “open to every AI agent, whether it’s built on ServiceNow, or built using Claude, Copilot, or a customer’s own agent” (ServiceNow press release). Snowflake moved earlier, making AI a SQL-native operator last June: AISQL’s AI_COMPLETE sits at the same level as FILTER and AGGREGATE.
The four companies did not coordinate their roadmaps. They are doing the same thing: turning software from GUI-first to a format agents can consume directly. Postman’s State of the API 2025 report, released in November 2025, dropped a striking pair of numbers: 89% of developers use generative AI daily, but only 24% have considered agents as a consumer when designing APIs. The 65-percentage-point gap in between corresponds to a vast sea of enterprise software: the capabilities are all there, but the interfaces weren’t designed for agents. That end, 89%. This end, 24%.
What Chen Yusen’s memo did was concrete: it took the engineering groundwork laid by predecessors and formalized it into an organizational charter. The person who actually did the work was Chen Hang.
Chen Hang returned to DingTalk in April 2025 and kicked off a year-long foundational overhaul. He rewrote DingTalk’s full set of enterprise capabilities — IM, audio and video, documents, approvals, scheduling, travel — into command-line instructions that AI can invoke, totaling over ten thousand commands. At the AI DingTalk 2.0 launch on March 17, 2026, Chen Hang himself put it this way: “All the pages DingTalk provides today have now been transformed into capabilities, compressed into command-line instructions, and made available for AI operations” (PingWest report). He added that what this builds is a control system similar to a Unix kernel.
Around this CLI, Chen Hang’s team also built the Realdoc file system (specifically designed for AI’s high-frequency reads and writes with frequent rollbacks) and an enterprise-grade security system. In late March 2026, within 24 hours of each other, DingTalk and Feishu (Lark) open-sourced their respective CLI tools on GitHub (Phoenix Tech report). DingTalk’s CLI isn’t just an internal pipe for its own Wukong agent — any agent that can invoke a command line can use it.
The “Corporate Information Technology Department” that Chen Yusen established is positioned as an internal infra team, working on DingTalk’s and Wukong’s own ERP, HR, finance, and approval systems, with a single goal: make these systems invocable by agents. Department head Deng Wu reports directly to the CEO. This is no longer something the engineering team pushes forward on its own. The CEO signed off, set up the department, defined the reporting line.
These events look like news, but the roots go far deeper than the news cycle.
Unix philosophy was the first to do this: everything is a file, programs do one thing, pipe & compose. This design let people write commands and scripts, delegate a batch of work to the machine for processing, without manually doing it every time. The earliest engineering practice of humans delegating work to machines began right here. When Chen Hang said he’s building a control system similar to a Unix kernel, it wasn’t a metaphor. He’s genuinely re-implementing Unix philosophy inside enterprise collaboration software.
After Unix, the next key node on this line is Roy Fielding. In 2000, he proposed REST in his doctoral dissertation, centered on two concepts: uniform interface and HATEOAS. Interfaces should be self-describing, support runtime discovery, and callers should not depend on external knowledge. HATEOAS in practice was almost never fully implemented (developers always hardcode endpoint paths), but its ideas were fully inherited by MCP: progressive disclosure, self-describing tool registry, agents exploring at runtime what tools are available.
Around 2010, Kin Lane, as the API Evangelist, pushed API-first design. His proposition: interfaces should be designed for machine consumers first, UI comes second. Twilio and Stripe were the earliest commercial companies to walk this path: their customers weren’t end users, they were developers writing code. Developers delegated communications and payments to Twilio’s and Stripe’s machines through APIs.
API-first and today’s agent-first differ in two critical ways. API-first assumes the consumer is deterministic code written by another developer. Agent-first assumes the consumer is a non-deterministic tool user autonomously invoked by an LLM. API-first cares about contracts and schemas. Agent-first, on top of that, has to think about how to name things in an intent-revealing way, how to write recovery hints, how to guarantee idempotency. The reason: there’s no human developer next to the agent to handle edge cases. Headless CMS in the 2010s pushed this thinking to the content layer: capabilities exist independently from the presentation layer, consumable by any consumer.
In 2023, two events pulled this line into the LLM era. OpenAI released function calling on June 13 — LLMs could output structured function calls for the first time. On September 28, Andrej Karpathy posted a tweet: “LLMs are not chatbots, they are the kernel of a new kind of operating system. Agents are processes, and tools are system calls.” What he was really saying: agents are a delegation layer running on top of LLMs. Humans delegate to agents, agents invoke tools, and tools are exposed capabilities.
From 2024 to 2025, the protocol layer delivered three things in succession. Anthropic released MCP in November 2024, solving how agents communicate with tools. Google released A2A in April 2025, solving how agents communicate with other agents. Anthropic released Agent Skills in October 2025, solving how agents communicate with procedural knowledge. Stacked together, these three form a protocol stack: MCP is vertical, A2A is horizontal, Skills is the semantic layer. In December 2025, MCP was donated to the Agentic AI Foundation under the Linux Foundation. OpenAI, Google, Microsoft, AWS, Block — all are founding members.
Let’s start with definitions. Simon Willison didn’t relent until September 18, 2025, saying the word “agent” had reached “a barely usable consensus definition” in engineering circles — then immediately added: enterprise circles still have no consensus. A word without even an aligned definition is already being used to set organizational structures and reporting lines.
Then there’s money. Goldman Sachs lead semiconductor analyst Jim Covello said in a public interview on May 26, 2026: enterprises are losing more money on AI integration today than they were two years ago. The data simply isn’t ready to be agented. Investment is going up, output isn’t showing.
The largest-scale agent integration experiment so far is Microsoft 365 Copilot. Gartner’s 2025 survey data: 40% of enterprises are piloting, only 5% have moved from pilot to scaled deployment. What’s the holdup? Gartner coined a term: oversharing. Agents can read more things than humans can, and the boundaries of data security haven’t been drawn clearly yet. Salesforce Agentforce isn’t having an easy time either — it went through three pricing models in 18 months, and out of 5,000 deals in the first two quarters, only 3,000 were paid.
There’s another, uglier one. The word “open” — what’s said on stage and what’s written in the actual terms are two different things.
SAP heavily promoted MCP openness at TechEd 2025, but at the same time, in April 2026, what did the updated API Policy v4 write in Section 2.2.2? It prohibits third-party agents from directly calling SAP APIs. Only their own Joule, MCP gateway, and BTP are allowed. Techzine’s report didn’t pull punches in its subtitle: “SAP blocks external AI agents. Salesforce and ServiceNow don’t.”
Slack took a different path. What did the API ToS effective October 2025 write? It prohibits third parties from indexing, copying, or long-term storing Slack messages. As soon as this came out, enterprise search platforms like Glean took a direct hit. Some customers called it a crisis of trust. They preach openness on stage, then lock the door in the contract.
Finally, there’s one more contradiction that’s even harder to get around. Behind Gartner’s oversharing warning hides a dead knot: making things easy for agents to access means making them easy for all agents to access — including the ones that shouldn’t be there. In mid-2025, Supabase’s Cursor agent had a Lethal Trifecta incident: service-role privilege, untrusted input, and external communication — three things colliding at once, resulting in a data leak. The MCPTox benchmark scanned the MCP ecosystem and found that tool poisoning is already widespread. This isn’t something a single vendor can fix with a few bug patches. For every new thing an agent can read or modify, you have to rethink who can invoke it and how to audit it.
Stack all of these problems together, and the core of this movement isn’t the word “agent.” It’s function-calling-first infrastructure.
Postman’s assessment that “the next consumer could be human or agent” is directionally right. But the word “agent” carries too much ambiguity. Willison chased it for two and a half years before reluctantly admitting there’s some consensus in engineering circles, and enterprise circles still have none. Covello’s data shows enterprises are still losing money on agent integration. Keep tying everything to the word “agent,” and the conversation easily gets stuck in definitional battles.
A better way to put it: agents are just one instance on the consumption side. What’s really taking shape is an infrastructure that enables software capabilities to be structurally discovered, semantically invoked, and securely executed. What this infrastructure contains is already quite concrete: at the protocol layer, MCP, A2A, and Agent Skills; in API design, intent-revealing endpoints, structured recovery hints, and idempotency guarantees; in knowledge organization, progressive disclosure and filesystem-based skills; in access governance, lethal trifecta constraints and oversharing boundaries. These are the engineering assets already taking shape. “Agent as first-class citizen” is catchy and spreads easily, but what’s actually moving on the engineering front is function-calling-first infrastructure.
Those 65 percentage points of gap in Postman’s data map directly to engineering components you can start building right now: CLI, MCP, structured schemas, access governance. Shouting “the age of agents is here” won’t close that gap.
The context infrastructure I use every day (full open-source implementation here), seen through this lens, is doing the same thing: turning environment, knowledge, and tools into interfaces agents can directly consume. These markdown files — SOUL.md, USER.md, WORKSPACE.md, AGENTS.md — are manually constructing, at the filesystem level, the information architecture agents need to operate. This direction is consistent with Snowflake making AI a SQL-native operator, ServiceNow recomposing Skills into MCP tools, and Chen Hang CLI-ifying the full set of DingTalk’s capabilities.
The combination of progressive disclosure and filesystem-based skills — Anthropic standardized and released it as Agent Skills in October 2025, but long before that, it had already been appearing in scattered independent agent engineering practices. I wrote a piece myself about writing skills before executing, and it’s about the same thing: externalizing working knowledge into markdown files so agents have reusable things to call. Before MCP, various tool-use protocols were running independently across different projects. Before REST, various RPC approaches were evolving independently across different companies. By the time standards catch up, engineering practice has already moved ahead for a while.
The line that began with Unix is still pushing forward. Whether “agent as first-class citizen” is the final form is hard to say, but function-calling-first infrastructure as a direction is already unlikely to roll back. Enterprise capabilities that have been hiding beneath the GUI for decades are being dismantled piece by piece. Not because someone wrote it into a KPI — because when you don’t use agents, they can stay hidden. As long as those 65 percentage points of gap in Postman’s data remain, these capabilities will keep being dismantled.