Who gave the AI agent permission to do that?
Photo by Jakub Żerdzicki on Unsplash
AI agents are beginning to do more than draft emails or summarise documents. They can navigate recruitment systems, retrieve invoices and move between applications using accounts their human operators have already signed into.
That raises the question: when an AI agent acts through a browser, whose permissions should it have?
Google has now set out how it intends to answer that question in Chrome Enterprise. In an August 2026 product update, the company described safeguards that police where browser agents can go, which information they can move and when they must stop to request human approval.
Chrome becomes the gatekeeper
Google offers two examples. A recruitment agent could scan public profiles and create candidate records in an applicant-tracking system. A finance agent could log into several supplier portals, retrieve PDF invoices and reconcile them automatically.
Both tasks require the agent to cross boundaries between public websites and private business systems. It may encounter personal information, confidential documents and authenticated accounts along the way.
Google is extending Chrome Enterprise protections to this new category of activity. Data-loss prevention controls are intended to inspect information moving through agentic workflows, while context-aware access rules can restrict an agent to information its human operator is authorised to use.
If an employee cannot export a particular dataset, the agent should not be able to export it either.
Chrome’s site-isolation architecture provides another barrier. Google says its auto-browse agent can be restricted to the websites relevant to the immediate task, preventing a manipulated agent from moving into an unrelated service where the user also happens to be logged in.
This is designed partly to address indirect prompt injection. A malicious instruction hidden on a webpage might try to divert an agent from its original task—for example, telling it to retrieve sensitive information from another application and send it elsewhere.
Google’s defence includes a separate high-trust model called the User Alignment Critic. Rather than completing the task itself, the model examines metadata about a proposed action and determines whether it remains consistent with the user’s original request.
Knowing when to stop
Some actions require more than automated checking. Google says Chrome’s auto-browse capability deliberately pauses before finalising a contract, completing a financial transaction or sending a mass email.
The employee must approve the action.
A work log shows what the agent did, while pages visited in the background are identified as agent activity in Chrome History. These records allow an employee to intervene and provide a starting point for investigators if the agent behaves unexpectedly.
Google has also expanded its vulnerability-rewards programme to cover Chrome’s agentic capabilities, offering up to $20,000 for verified breaches of its agent-security boundaries.
The company’s proposition is clear: because so much work already happens through web applications, Chrome can become an enforcement layer between an AI agent and the systems it uses.
That is also commercially convenient for Google. Making the browser an agent-control point increases the value of Chrome Enterprise Premium and embeds it more deeply in corporate security architecture.
Microsoft extends Zero Trust to agents
Microsoft is approaching the problem from beyond the browser.
Microsoft 365 Copilot Cowork can use websites through a hidden Edge tab, operating through services where the user is already signed in. Administrators can enable or disable this browser access and specify the sites on which it may operate.
Microsoft’s wider strategy centres on extending Zero Trust principles across agents, applications and infrastructure. Its August security update applies three established rules to AI: verify explicitly, grant the least privilege necessary and assume that a breach will occur.
Microsoft Agent 365, generally available since May 2026, gives organisations a central place to observe, govern and secure Microsoft and compatible third-party agents. Microsoft Entra controls agent identities and access, Purview governs the data they use and Defender monitors threats.
Google’s proposal is more browser-centred. Microsoft treats the browser as one execution environment within a security system intended to follow agents across the organisation.
New AI browsers put the agent first
Perplexity has taken a more direct route with Comet, a browser built around its AI assistant.
Comet Enterprise allows administrators to restrict domains, limit the tasks assigned to agents and decide which actions require approval. When an advanced agent or automation runs for the first time, users can allow it once, approve future use or refuse permission.
Permanent approval is convenient, but every retained permission increases the potential consequences of a compromised webpage, deceptive instruction or stolen session.
Opera previewed a similar Browser Operator in 2025. It said the agent ran locally in the browser and used existing sessions without sending login credentials to a third party. Opera’s newer Neon browser goes further, acting across tabs and allowing connections to external agents through the Model Context Protocol or a command-line interface.
Firefox currently occupies a different position. Mozilla has introduced central controls that let users disable individual AI functions—or block current and future AI enhancements altogether. Firefox offers AI-assisted features, but not comparable autonomous browser operation. Its clearest point of difference is therefore user choice over whether AI participates at all.
A new identity problem
None of these approaches completely resolves the underlying difficulty.
If an agent simply inherits a user’s identity, it may receive access accumulated over years and far beyond the needs of one task. If it receives a separate identity, companies need systems for issuing, monitoring and withdrawing those permissions. Agents that call other agents or use external tools make attribution harder still.
The OWAS Top 10 for Agentic Applications identifies agent goal hijacking, tool misuse, and identity and privilege abuse among the main emerging risks.
Browser companies are converging on several protective principles even as their architectures differ: restrict the agent’s territory, inspect the information it handles, record what it does and keep a human close to irreversible decisions.
The competition to build an AI browser is therefore becoming a competition over trust. The browser that acts most independently may not be the one companies prefer. In the workplace, the more valuable browser may be the one that knows when an agent should not be allowed to continue.
Further reading on MoveTheNeedle.news:
Veeam launches Agent Commander to help enterprises manage AI agent risk
Why agentic AI is stalling — and why orchestration has become the trust anchor
SentinelOne brings agentic AI into AWS — and closer to real-world security operations