What is dual control?
The rule that a person can always do by hand whatever an agent is doing on their behalf.
Dual control — Dual control, in software, is the design rule that every action available in the interface is also available as a programmatic tool with identical effect, and vice versa. It guarantees that automation never depends on a path a person cannot take by hand.
Why it matters
Dual control is a design discipline, not a feature. It means that for every button in the interface, there is a tool call with the same effect, and for every tool call an agent might make, a person could get the identical result by clicking through the app. Neither path is a shortcut around the other.
The value shows up when automation is turned off, not when it is on. If a team disables an agent, or a specific integration goes down, dual control guarantees the work can still get done by hand, because the manual path was never allowed to lag behind the automated one. Without this rule, teams end up with automation-only actions that a person cannot reproduce when they need to. The moment an agent misbehaves and someone tries to do the same thing manually to check it, the manual path turns out not to exist. In SalesCrew, this is implemented as a rule that no MCP tool ships without a matching UI action, and no UI action ships without a matching tool.
How dual control gets built
- 1
An action is designed
For example, moving a deal to a new stage.
- 2
A UI control is built for it
A button or a form field a person can use directly.
- 3
A matching tool is built for it
The same action, callable by an agent with the same arguments.
- 4
Both are tested against the same permissions
Neither path is allowed to do more, or less, than the other.
- 5
Both are kept in sync going forward
A change to one action's behaviour has to update both paths at once.
The mistake to watch for
Questions
- How is dual control different from an API?
- An API is any programmatic interface to a system; it does not promise that every UI action has an API equivalent, or the reverse. Dual control is a stricter guarantee specifically about parity: every interface action and every programmatic action mirror each other exactly.
- Why does dual control matter if a team plans to run mostly on autopilot?
- Because autopilot fails sometimes: an integration goes down, an agent is paused during an incident, a new hire needs to do something the agent normally handles. Dual control is what keeps the team able to work when the automated path is unavailable.
- Does dual control slow down building new features?
- It adds work up front, since every action needs two interfaces instead of one. The tradeoff is that neither the UI nor the automated layer becomes the source of unrepeatable, undocumented behaviour later.