Approvals and safety
Nothing consequential happens without you saying so, and the refusal is enforced rather than requested.
Before anything leaves this product, the run stops and shows you the exact action: what it will do, which tools and sources it used to decide, your answers to any questions it asked, and which version of the agent is asking. The request expires after ten minutes.
Denying is not a pause. The downstream model and browser handlers do not run, and there are no write tools available to work around it.
A step that may read a page cannot click, type or submit on it. Acting is attached separately and every act is approved first. This is why the two appear as different tools on the diagram rather than one.
Claims in an answer are checked against the pages the agent actually observed, with the screenshots and node outputs kept. That checks provenance — that the agent saw what it says it saw. It does not check whether the page was telling the truth. A run that could not establish something stays marked uncertain rather than being rounded up to confident.
- Force
- Every consequential step is held for approval by the runtime. The control is enforced.
- Browser Use
- A hosted agent that is asked to stop and report before anything consequential. That is an instruction, not a control, and the diagram says so.
Deciding whether a click is consequential is a judgement, and any judgement can be wrong: a button can be mislabelled, re-rendered, reached by keyboard, or wired to send its request through code rather than a form. So there is a second line underneath that does not depend on reading the page at all. While a step nobody has approved is in flight, a request that would change something at the sites the agent is working on is held, and the run parks and says which rule caught it.
It is judged by what the agent was doing rather than by the kind of request, because most of the web reads over the same kind of request it writes with. A delivery site loading a menu, a search and a basket is browsing. Placing the order is not, and a request that arrives a second after the click that caused it still belongs to that click.
A window goes cold. If nothing the agent did can account for a request — it arrives long after the step that might have caused it — it is not attributed to the agent, and it is not held. That is the honest edge of this: the backstop covers what the agent caused, not everything a page might eventually do on its own.
A payment that has already left for the bank is also past the point where software can call it back. When that happens the run stops and hands it to you rather than pretending it can undo it.