Bounded Agency as the Product

BrowserSkill is best understood as a system for governing useful browser agency, not as a promise that an AI agent can safely operate any page it can reach. The central question is the one that motivated this series: can an agent use a real, already-logged-in browser while the user retains meaningful control over windows, tabs, human decisions, and uncertain effects? The answer is conditional. BrowserSkill makes that arrangement more legible through layers, session state, explicit tab claims, fresh evidence, human boundaries, reconciliation, and cleanup. Those mechanisms are valuable precisely because they do not pretend to remove the power or ambiguity of a real browser.

Useful access becomes governable through explicit ownership

The coherent model is a layered bridge. An agent harness expresses intent through the bsk CLI. The CLI reaches a daemon over local IPC; the daemon selects a browser connection and session route; the extension receives a typed request over the browser link; and the extension applies session and target rules before using Chrome APIs or the browser debugging protocol. The page remains the owner of its own state and side effects. This division explains both the reach of the system and its limits.

The session is the bridge's unit of memory. It binds an opaque handle to an Agent Window, a reference context, explicit agent-created tabs, and borrowed-tab records. The home tab is claimed at session start, while other tabs require an explicit creation or borrowing path. Stopping a session returns user-owned tabs before closing agent-owned resources and preserves a retryable failure when return cannot be confirmed. The session does not make a browser profile independent or turn a page operation into a transaction. It gives the runtime a place to record what the task created, what it borrowed, and what it still owes the user.

That ownership model is what makes reuse of real login state more governable. Without it, the distinction between “the agent can see a tab” and “the agent may act in that tab” would disappear. A visible user tab can help a local task identify its target, but remote access requires a task-created or explicitly borrowed target. A page-opened popup does not become authorized merely because it appears in an Agent Window. Another session's Agent Window is not part of a global pool. Borrowing records the original location, asks for approval according to the browser's saved preference, reserves the tab against competing sessions, moves it into the Agent Window, and later returns it or reports why return remains unresolved.

The result is not harmlessness. A paired remote server can still operate signed-in sessions. A local agent can still submit a form after the user authorizes the relevant tab. A returned tab can still contain a page effect that cannot be undone. The value lies in making the control transition visible and attributable. The agent should be able to say which session owned the target, whether the user authorized the handoff, which part of the task was performed, and whether cleanup finished.

The same principle explains why a plugin can share infrastructure without sharing ownership. DeepSeek Harness can expose native browser tools while running the same bsk bridge, but its registry tracks only sessions it created. A session from another terminal or agent is not adopted because its ID happens to be known. Plugin unload and archive cleanup cannot stop a foreign session. The adapter changes the interface and presentation; it does not erase the session boundary.

A useful summary is: BrowserSkill is not selling direct browser access. It is selling a controlled path through which an agent may request browser access under conditions that remain inspectable. The path is stronger than a raw command runner because it carries ownership and lifecycle state. It is weaker than a transactional business API because page effects, human intent, and external services remain outside the bridge's complete control.

The feedback loop is the capability

The system's real capability is not any single click, screenshot, or navigation command. It is the loop that connects evidence, scope, action, verification, human participation, interruption, and cleanup.

The loop begins with observation. BrowserSkill's semantic observe path captures page structure, accessibility information, forms, frames, geometry, and optional visual facts, then publishes fresh references. A new observation replaces the session's reference context; a document change invalidates references for that tab because a browser node identity may be reused by a new document. A continuation cursor can finish reading the same captured page, but it is not a way to make an old capture current after navigation.