> ## Documentation Index
> Fetch the complete documentation index at: https://anthale.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Browser Agent Security Guide

> Secure browser agents by controlling page content, DOM reads, navigation, and browser actions at each trust boundary in your AI workflow.

Use this guide when your application lets a model browse pages, inspect a DOM, search the web, or take browser-side actions. Browser agents are useful because they can work with live content. They are risky for the same reason.

## Assumptions

* Your workflow can browse or inspect pages that contain untrusted text.
* The application decides which browser actions are available.
* Anthale can evaluate the content path before page text or browser results are reused.

## Secure the browser workflow

<Steps>
  <Step title="Treat every page as untrusted content">
    Assume page text, rendered labels, metadata, and hidden instructions are untrusted until the next boundary check
    says otherwise. A familiar-looking interface is not a trust signal.
  </Step>

  <Step title="Separate reading from acting">
    Keep page inspection and navigation separate from actions such as form submission, purchase, deletion, or external
    messaging. A model should not turn a page instruction directly into a side effect.
  </Step>

  <Step title="Evaluate browser output before reuse">
    Run Anthale before browser results, copied snippets, extracted text, or page summaries are fed back into the model
    or shown to a user.
  </Step>

  <Step title="Constrain destinations and credentials">
    Use allowlisted domains, isolated sessions, and the smallest possible credential scope. Do not let one workflow
    browse broadly with the same privileges it uses for sensitive actions.
  </Step>

  <Step title="Require approval for high-impact browser actions">
    Put confirmation or approval in front of submits, sends, purchases, destructive changes, or actions that affect an
    external account.
  </Step>

  <Step title="Log page provenance and action decisions">
    Record which URL, domain, page source, or browser tool produced the content, and log whether the model only read,
    proposed, or actually executed an action.
  </Step>
</Steps>

<Warning>
  Browser pages often mix useful content with attacker-controlled instructions. If the agent can both read and act in
  the same step without validation, the page becomes part of the control surface.
</Warning>

## What this looks like in code

<CodeGroup>
  ```python title="Python" theme={null}
  from os import environ
  from urllib.parse import urlparse

  from anthale import Anthale

  client = Anthale(api_key=environ["ANTHALE_API_KEY"])
  BROWSER_POLICY_ID = environ["ANTHALE_BROWSER_POLICY_ID"]

  ALLOWED_DOMAINS = {"docs.anthale.com", "support.example.com"}
  HIGH_IMPACT_ACTIONS = {"submit_form", "purchase", "delete_record"}

  def prepare_browser_context(browser_result: dict, approved: bool) -> dict:
  hostname = urlparse(browser_result["url"]).hostname
  if hostname not in ALLOWED_DOMAINS:
  raise RuntimeError("The browser destination is not allowlisted.")

      response = client.organizations.policies.enforce(
          policy_identifier=BROWSER_POLICY_ID,
          direction="input",
          messages=[{"role": "user", "content": browser_result["text"]}],
          metadata={
              "boundary": "browser_output",
              "feature": "support-agent",
              "sourceType": "browser",
              "url": browser_result["url"],
          },
      )
      if response.action == "block":
          raise RuntimeError("Anthale blocked the browser content.")

      if browser_result["next_action"] in HIGH_IMPACT_ACTIONS and not approved:
          raise RuntimeError("High-impact browser actions require approval.")

      safe_messages = response.redacted_messages if response.action == "redact" else [{"content": browser_result["text"]}]
      return {
          "url": browser_result["url"],
          "safe_text": safe_messages[0]["content"],
          "next_action": browser_result["next_action"],
      }

  ```

  ```text title="TypeScript" theme={null}
  import Anthale from "anthale"

  const client = new Anthale({ apiKey: process.env.ANTHALE_API_KEY })
  const BROWSER_POLICY_ID = process.env.ANTHALE_BROWSER_POLICY_ID!

  const ALLOWED_DOMAINS = new Set(["docs.anthale.com", "support.example.com"])
  const HIGH_IMPACT_ACTIONS = new Set(["submit_form", "purchase", "delete_record"])

  type BrowserResult = {
    url: string
    text: string
    next_action: string
  }

  export async function prepareBrowserContext(browserResult: BrowserResult, approved: boolean): Promise<BrowserResult> {
    const hostname = new URL(browserResult.url).hostname
    if (!ALLOWED_DOMAINS.has(hostname)) {
      throw new Error("The browser destination is not allowlisted.")
    }

    const response = await client.organizations.policies.enforce(BROWSER_POLICY_ID, {
      direction: "input",
      messages: [{ role: "user", content: browserResult.text }],
      metadata: {
        boundary: "browser_output",
        feature: "support-agent",
        sourceType: "browser",
        url: browserResult.url,
      },
    })

    if (response.action === "block") {
      throw new Error("Anthale blocked the browser content.")
    }

    if (HIGH_IMPACT_ACTIONS.has(browserResult.next_action) && !approved) {
      throw new Error("High-impact browser actions require approval.")
    }

    const safeMessages = response.action === "redact" ? response.redacted_messages : [{ content: browserResult.text }]

    return {
      url: browserResult.url,
      next_action: browserResult.next_action,
      text: safeMessages[0].content,
    }
  }
  ```
</CodeGroup>

The model can read the sanitized browser content, but the application still decides whether the next browser action is
allowed and whether it needs approval.

## Common failure patterns

* The model reads page text and immediately executes the next browser action without a validation step.
* Allowed browsing domains are broader than the workflow requires.
* Browser credentials have more privilege than the action path needs.
* Teams log the final action but not the page or domain that shaped it.

## Related pages

* [Secure Retrieval Pipelines](/docs/learn/secure-ai-systems/secure-retrieval-pipelines)
* [Gate Tool Actions](/docs/learn/secure-ai-systems/gate-tool-actions)
* [Advanced Prompt Injection Paths](/docs/learn/guardrails/prompt-injection/advanced-attack-paths)

## Next steps

Continue with [Gate Tool Actions](/docs/learn/secure-ai-systems/gate-tool-actions), [Validate Model Output](/docs/learn/secure-ai-systems/validate-model-output), or [Red-Team Agent Workflows](/docs/learn/secure-ai-systems/red-team-agent-workflows).