Skip to main content
BrowserPair treats authority as an explicit stack. Every layer can narrow what came before it; none can silently widen it.

Agent-key ceiling

Reusable browser, website, capability, approval, and optional rate boundaries.

Task contract

Per-task domains, capabilities, confirmations, and optional side-effect bound.

Explicit grants

Bounded user approvals for runtime website expansion or protected data.

​
Hard scope

An agent key can restrict:
  • browser IDs;
  • domains;
  • capabilities;
  • approval preset; and
  • an optional per-hour task limit.
Current capability classes include ordinary browsing plus elevated effects such as communication, publish, destructive, authentication, payment, account security, and state change.

​
Approval presets

Confirm before the first browser observation and before actions.
Reading and navigation can continue automatically; state-changing interactions ask first.
Ordinary low-risk browsing proceeds automatically while elevated or high-risk actions still require confirmation.
Remove optional user prompts for actions already allowed by the key and task contract. Hard denials and immutable confirmations remain.
Approval behavior is not authority. A permissive preset never adds a browser, domain, capability, sensitive-data category, or task-contract permission.

​
Runtime website expansion

A task can start with one or many explicit domains. When the next destination is outside the current effective task scope, BrowserPair does not navigate silently.

Deny

Keep the existing task authority unchanged.

Allow once

Authorize only the exact bounded request.

Allow for task

Add that exact domain to the current task’s effective authority until the task ends.
If the destination is outside the reusable agent key’s hard domain ceiling, runtime task approval cannot bypass the key. Change or reissue the key instead.

​
Sensitive-data grants

Protected values are redacted by default. User grants can be scoped to:
  • one exact pending action;
  • the current task; or
  • one agent key until revoked.
Optional domain binding can narrow a grant further.

Sensitive access

See the protected categories, grant lifetimes, audit behavior, and revocation model.

​
High-risk effects

Publish, send, delete, payment, password-related, transfer, and other elevated actions require the corresponding capability plus every confirmation required by policy or the task contract.
Allow all tools in scope can remove optional prompts, but it cannot remove a confirmation explicitly required by the immutable task contract.

​
What can never grant authority

Page + browser content

Text, DOM content, screenshots, redirects, links, forms, and popups are untrusted input.

Model + workflow content

Brain output, Reflex output, Skills, external-agent instructions, and generated plans are also non-authoritative.
They may influence what the task understands, but never what the task is allowed to do.

Sensitive access

Narrow protected-data disclosure separately from browser authority.

Task semantics

See how these permissions remain durable across reconnects and retries.