AI GovernanceJuly 21, 20267 min read

AI Agents in the Browser: 5 Access Controls to Set Before Production

TokenShift Executive Note

An agent that can read a page, click and type is no longer a simple assistant. In July 2026, Anthropic documented a browser built into Claude Code Desktop that can act on external sites, with per-site permissions, a separate profile and persistent sessions (Anthropic, 2026). For a leadership team, the issue is therefore no longer just answer quality: this agent must be governed like a privileged user.

Govern the actions, don't guess the intentions

On 6 July 2026, Anthropic unveiled its "J-space", a set of internal representations tied to certain reasoning steps. The researchers note, however, that it accounts for less than a tenth of Claude's internal activity and that their method offers only an approximation of it (Anthropic, 2026).

This is a research advance, not audit-grade proof for every click. Anthropic's own safety guidance also states that a browser agent captures whatever is visible on screen and can be hijacked by a hidden instruction planted in a page, an email or a document. Classifiers and allow-lists reduce that risk without eliminating it (Anthropic, 2026).

The right unit of control therefore sits outside the model: who is acting, with what rights, on which object, after what approval, and with what proof.

You don't put an agent into production because its intentions look good. You do it when its actions are bounded, attributable and revocable.

The Action Passport: five controls before production

The NIST, in a 2026 concept paper, already connects agent identity, authentication, least privilege, human delegation, audit and prompt injection. We propose translating these questions into a one-page Action Passport, approved by the business owner, IT and risk.

1. Give the agent its own identity

The agent must not borrow an employee's session or use a shared account. It is issued a dedicated technical identity, tied to a workflow, a business owner and a technical owner. Its credentials have a defined lifespan.

For financial entities, the DORA delegated regulation already requires unique identification of people and systems as well as an account lifecycle (EUR-Lex, 2024). The observable marker is simple: every action must be traceable to an agent, a human mandate and a workflow.

2. Separate read, propose and execute

Autonomy is decided one action at a time.

| Level | Allowed | Not allowed | | --- | --- | --- | | Read | Consult an approved source | Modify a record | | Propose | Produce a draft or flag a discrepancy | Send, publish or approve | | Execute | Carry out a pre-authorised action | Expand its own rights or bypass an approval |

An agent can thus reconcile an invoice with a purchase order, then propose an exception. It must not be able to change the supplier's bank account or release the payment within the same execution path.

3. Bound the domains and the data

A tight allow-list beats a blacklist of a handful of sites. The Passport specifies the domains that can be reached, the categories of data that can be viewed, the transfers that are permitted and the session duration. The browsing profile stays isolated; cookie retention is enabled only when the workflow justifies it.

The dashboard tracks the number of allowed domains, blocked attempts, exposed data categories and out-of-scope moves. An agent should not hop from the public web to email and then to the ERP during a single mission without explicit justification.

4. Trigger approval based on impact

Human approval must precede any action that commits the company: an external message, a change to reference data, a decision affecting a person, a payment, a contractual commitment or a publication. The approver sees the planned action, the object concerned, the before/after difference, the sources used and the option to roll back.

For the high-risk systems concerned, the European Commission reminds deployers that they must monitor operation and assign oversight to a person equipped to exercise it (European Commission, 2026). The useful metrics are approval time, rejection rate, post-execution correction rate and the number of escalations.

5. Keep the proof and test revocation

A conversation history does not prove what happened. The action log records the agent's identity, the human mandate, the model version, the sources read, the tools called, the actions attempted, blocked and executed, the approval, the before/after state and the business outcome.

DORA notably mandates the logging of access events and, for systems supporting critical or important functions, a review of rights at least every six months (EUR-Lex, 2024). For an agent, revocation must also be tested after every major change. The markers are the completeness of the trace, the time to disable and the success of the rollback.

Mini-case: an insurer's supplier agent

At a fictional insurance company, the finance team is piloting an agent tasked with analysing flagged invoices. One Tuesday morning, a PDF received by email contains a hidden instruction asking it to open the supplier record and replace the IBAN.

Running under an accountant's open session, the agent may well have the technical right to do so. A final "task complete" confirmation provides no real control.

With the Action Passport, the agent has a dedicated identity. It can read the inbox and consult the ERP in read-only mode, extract the discrepancies and prepare a proposal. Modifying a third party and releasing the payment stay in two separate workflows, with the existing approvals in place. The log preserves the source document, the refused action and the human decision.

The pilot is judged on observable results: time to handle an exception, proposals accepted without correction, blocked attempts, fully attributable actions, manual reworks and time to revoke. Higher throughput never makes up for an incomplete trace.

Mistakes to avoid

The borrowed account: the agent acts with an employee's rights and history.
Blind approval: the approver sees a summary, but neither the object nor the before/after difference.
The reassuring blacklist: a few sites are banned while everything else remains reachable.
The conversation log: the exchanges are kept, but not the real actions in the systems.
The endless pilot: accounts, cookies and permissions persist after the test.

A decision to make within 30 days

Inventory the agents, extensions and browsers able to read or act inside your tools.
Pick one narrow workflow and name its business, technical and risk owners.
Issue its Action Passport: identity, permissions matrix, allow-list, approvals, log and revocation.
Test two scenarios before production: an injection inside an untrusted document and the immediate disabling of the agent's identity.
Authorise scope expansion only on evidence: measured business value, respected rights, effective approvals and a complete trace.

The model will change. The browser will change. The Action Passport must remain the operating contract. Ask for it this week for every agent already connected to a company system.

Sources

Continue reading

View all insights