Working Thesis · June to July 2026

Design That Keeps Pace With AI Is an Architecture Problem

I design the systems around the screens: agentic experiences, the identity systems that give them trust, and the owned, federated MCP architecture that lets AI generate real, compliant product, with humans directing. Below, one request through that system, told for whichever room the reader is in.

This is my thinking from June and July 2026, a snapshot and not a finished position. The facts in it were re-checked in October 2026, and where a claim is a proposal and not a standard, the page says so.

The Short Version

Production Is Abundant. Direction Is the Job.

AI can now generate screens, components and code faster than a design process can review them. That moves the hard problem from production to architecture: who owns which part of the system, what a model is allowed to touch, and what must be checked by code instead of trusted to judgment.

My answer is an owned, federated architecture. A person sets the goal in plain language. A Claude orchestrator plans, and a small set of agents with narrow roles gathers context, builds the flow and runs the checks. Every call to a tool or a data source crosses one MCP gateway that the company runs, so the permissions, the monitoring and the audit trail are the company’s own. Nothing ships until a person approves it.

The part that makes this design work, and not only engineering work, is the split between the Skin and the Skeleton.

The Durable Layer

Skin and Skeleton: What Design Actually Owns

Nearly a decade ago, Alla Kholmatova split design systems into two kinds of pattern: functional patterns, the concrete parts like buttons and forms, and perceptual patterns, the expressive styles that carry personality, like color, type and motion (Design Systems, 2017). In an AI-generated world, that distinction becomes an ownership decision. Skeleton and Skin are my names for the two owners.

Functional Patterns

The Skeleton

Engineering-Owned

The component substrate: the library, its prop contracts and what actually ships. Any capable agent can read it and assemble it. It is plumbing: necessary, valuable and increasingly commoditized, because AI can generate a button.

  • Lives in code, versioned in Git
  • Prop contracts generated from code, not re-authored
  • Swappable: MUI, Radix, in-house, whatever is next

Perceptual Patterns

The Skin

Design-Owned

The brand and identity system, meaning tokens plus brand rules. It is the layer that signals trust and makes a product recognizably itself. This is the invariant, and it is where design’s irreplaceable value concentrates.

  • Portable across any substrate
  • Tokens (DTCG format) plus structured brand logic
  • The part a person has to stand behind

One Skin dresses many Skeletons, which is why it survives when the front-end library churns.

Front-end libraries churn: MUI, Radix, in-house, whatever is next. Bind a system’s identity to a specific substrate and it is fragile; the day engineering re-platforms, the design system re-platforms with it. A portable brand and identity layer survives that. It is the same principle I would apply anywhere a system has to outlast its parts: loose coupling, or architecting for failure, applied to the design system itself.

This is also where I stop trusting the marketing. Vendors say their tool is “the source of truth.” The useful question is never which tool. It is which field, owned by whom, enforced how. A tool that owns visual intent does not therefore own behavior, policy or shipped pixels. Read the architecture, not the announcement.

And one honest limit, because a credible model names them: this does not mean designers live inside a chat window. Working through Claude is right for generation and decision, the high-leverage judgment. But visual craft and exploration still want a canvas. The canvas does not disappear; its job narrows to exactly where human visual judgment actually lives.

How the Thinking Moved

From “Code Is the Truth” to Federated Ownership

The earlier version of this thinking said code is the truth and Figma is the canvas: tokens as version-controlled JSON, components with machine-readable prop contracts, and parity as a pipeline instead of a person.

The later version keeps the pipeline and drops the slogan. There is no single source of truth. There is federated ownership: each field has exactly one system of record, token values live in the repo and sync to Figma, prop contracts are generated from code, and a drift checker flags mismatches instead of silently deciding which side wins. The reason is simple: a tool that owns visual intent does not therefore own behavior, policy or shipped pixels.

Point of View

Four Positions This Architecture Takes

Each is a deliberate decision, and each is defensible against current practice.

  • Federated Truth

    No Single Source of Truth. Federated Ownership.

    Visual intent belongs to Figma; component identity, behavior and policy to the registry; token values to the repo, synced to Figma; shipped appearance to code. Different fields, different systems of record. Drift is flagged, never silently resolved: the system surfaces the mismatch and a human decides.

  • Human in the Loop

    Judgment Is the Thing Under Test

    A legal disclosure, an accessibility rule or an approval gate cannot be verified by trusting a model’s inference, so a deterministic validator checks the work. The agent’s judgment is exactly what is being tested. That makes human-in-the-loop structural, not sentimental, and it makes the designer meta: I design the system that designs.

  • Own the Doorway

    The Gateway Is Ours. Vendors Connect Under Our Policy.

    Every agent reaches every system through an MCP gateway the company runs: its permissions, its monitoring, its audit trail. Vendor servers, including Figma’s write-to-canvas server, plug in under those policies instead of defining them. The MCP specification covers how a client connects and authorizes; the gateway, and the audit log it keeps, are what this architecture adds. Owning the doorway turns “AI in the workflow” from a risk conversation into a governance capability.

  • Lean by Design

    Bind Only What Must Never Go Wrong

    Schemas are not for the agent to comprehend; they are for a validator to check its work. So the must-not-fail set is bound rigidly and a capable agent reasons over the rest. The test is one question: if this were violated once, would that be acceptable? If not, it is a guardrail, enforced in the pipeline. Over-specify everything and the result is the brittle, rigid system AI was supposed to dissolve.

Intellectual Honesty

What’s Honestly Unsolved

A credible architecture names its open problems.

Evaluation is young: measuring generation quality and retrieval accuracy takes real eval suites, and most teams, including this proof of concept, are still building that muscle. Model behavior shifts between versions, which is exactly why the deterministic guardrail layer exists. And the hardest part is not technical at all: it is organizational adoption.

That is why the operating stance is adaptation. No one has the proven playbook yet. The advantage belongs to teams whose systems are built to absorb change: tokens that propagate, contracts that version, agents whose rules are edited in one place, a Skin that outlives its Skeleton. This page, the design system it links to and the process that built both are that stance, practiced.

Checked in October 2026

What to Know Before Relying on This

Four facts that shape how far the architecture can be taken today.

  • MCP

    The Model Context Protocol is an open standard for connecting AI applications to outside systems. Its specification includes an optional, OAuth-based authorization step for remote servers. It does not define a gateway or an audit log. Those are the layer this architecture proposes.

  • Tokens

    Design tokens are written in the Design Tokens Community Group (DTCG) format, which reached its first stable version in October 2025. It is a Community Group specification, not a W3C standard.

  • Figma

    Figma’s write-to-canvas tool lets an agent build in a Figma file with the team’s own library, and it needs a Full seat. Writing tokens into Figma variables through the REST API is limited to Enterprise organizations; a plugin is the alternative on other plans.

  • Illustrative

    The timings, counts and audit-log totals in the diagrams are example values chosen to show the shape of a run. They are not measurements.

Grounded In