An agent that drives your browser or desktop acts with your sessions, cookies and permissions, so it can do anything you can do while signed in: read mail, move money, change settings. That is ambient authority. Shrink it with a separate profile, limited accounts, approvals for sensitive pages and no mixing of personal and work sessions.
What ambient authority means
Normally an app asks for a specific permission. An agent working through your screen asks for nothing; it simply clicks. Every site where you are logged in is available to it, with no extra prompt, because to the site the agent is you.
That is fine when the page content is trusted. It is a problem when the agent reads something an attacker wrote, such as a web page, an email or a document, that tells it to act. The agent has your authority, the attacker has its attention.
Realistic bad outcomes
- A hidden instruction on a page makes the agent open your webmail and forward a message.
- A shared document tells the agent to change a setting in your admin console.
- An agent summarizing a thread also reads a reset link and uses it.
None of this requires a bug in your browser. It follows from giving a text-following system your logged-in state.
Ways to shrink the authority
Use a dedicated browser profile. Sign in only to the sites the task needs. Keep email, banking and admin consoles out of it.
Use a lower privilege account. For work tasks, a standard user or read only role instead of an admin. Sign out of admin sessions before starting an agent task.
Separate reading from acting. Let the agent browse and gather with no ability to submit forms or send messages, then act yourself.
Gate sensitive pages. Require confirmation before the agent touches payments, account settings, or anything that sends data out.
Watch the session. Do not leave an agent running unattended on a signed in machine with broad access.
Limit what it can see. Close tabs with sensitive content before starting.
A quick self test
Before you start an agent task, ask:
- If a web page I will visit were hostile, what is the worst the agent could do from this session?
- Would I be comfortable if that happened right now?
- Can I remove one sign in and still do the task?
If the worst case is bad, narrow the session first.
How this connects to design rules
The idea is the same as the third leg of the Rule of Two: the ability to act. Read the Rule of Two to see how to remove one of the three legs. For an agent that sits in your browser, the usual choice is to remove either private data or the ability to act.
Where Safeguard fits
Safeguard's policies and MCP Guardrail help control the tools agents call, and agent identity gives agents their own scoped access instead of yours. Safeguard's browser extensions can check a package before you install it.
Quick check
Is it safe to let an agent use my work browser?
It carries risk, because it inherits all your sessions. A separate profile with only the needed sign ins is safer.
What is ambient authority?
Authority an agent has simply because it runs inside your signed in context, without a specific permission grant.
Last reviewed: 19 October 2026.
