LLM-Native Browser
Agentic browsing binds observation, action, authority, and evidence into controlled execution—not merely page viewing.
Engineer DOM, accessibility, and visual state with session isolation, tool authority, approvals, and reproducible execution records.
§ 01
The operating conditions that justify LLM-Native Browser
On dynamic pages, divergence between model observation and click target can record incorrect actions as successful.
A browser mixing cookies, credentials, and external input becomes a boundary for prompt injection and authority misuse.
- Human web workflows without APIs must be automated audibly
- Pre-action approval and result evidence must be preserved at each step
- A stable official API performs the same work
- Credential isolation and distrust of external content cannot be enforced
LLM-Native Browser: system plate
- 01
State 1
Capture page observation as synchronized DOM, accessibility, visual, and network evidence.
- 02
State 2
Separate read, input, submit, and download authority with approval before irreversible actions.
- 03
State 3
Separate instructions from external content from user and policy instructions in the execution layer.
- 04
State 4
Retain pre/post-action state and failure causes in an event log and replayable run bundle.
FEEDBACKFailed acceptance returns evidence to the first controlled stage: Task success and incorrect-action rate.
- The workflow begins with Capture page observation as synchronized DOM, accessibility, visual, and network evidence..
- It reaches an acceptance decision through Task success and incorrect-action rate.
§ 03
Fix the boundary and acceptance criteria before implementation.
Agentic browsing binds observation, action, authority, and evidence into controlled execution—not merely page viewing.
- 01
Stage 1
Capture page observation as synchronized DOM, accessibility, visual, and network evidence.
Review artifact 1 - 02
Stage 2
Separate read, input, submit, and download authority with approval before irreversible actions.
Review artifact 2 - 03
Stage 3
Separate instructions from external content from user and policy instructions in the execution layer.
Review artifact 3 - 04
Stage 4
Retain pre/post-action state and failure causes in an event log and replayable run bundle.
Review artifact 4
§ 04
Hypothetical workloads make the applicability boundary concrete.
Human web workflows without APIs must be automated audibly
On dynamic pages, divergence between model observation and click target can record incorrect actions as successful.
- APPROACH
- Capture page observation as synchronized DOM, accessibility, visual, and network evidence.
- BOUNDARY
- Demo success is not generalized to reliability on changing live websites.
Pre-action approval and result evidence must be preserved at each step
A browser mixing cookies, credentials, and external input becomes a boundary for prompt injection and authority misuse.
- APPROACH
- Separate read, input, submit, and download authority with approval before irreversible actions.
- BOUNDARY
- Browser authority must not exceed user authority.
§ 05
Review gains and costs in the same table.
| Decision | Gain | Cost | Watch |
|---|---|---|---|
| Human web workflows without APIs must be automated audibly | Capture page observation as synchronized DOM, accessibility, visual, and network evidence. | Demo success is not generalized to reliability on changing live websites. | Task success and incorrect-action rate |
| Pre-action approval and result evidence must be preserved at each step | Separate read, input, submit, and download authority with approval before irreversible actions. | Browser authority must not exceed user authority. | Approval and authority violation detection |
LLM-Native Browser: system plate
- On dynamic pages, divergence between model observation and click target can record incorrect actions as successful.
- Demo success is not generalized to reliability on changing live websites.
- Separate read, input, submit, and download authority with approval before irreversible actions.
- Task success and incorrect-action rate
- Run reproducibility and evidence completeness
- Browser authority must not exceed user authority.
- The workflow begins with Capture page observation as synchronized DOM, accessibility, visual, and network evidence..
- It reaches an acceptance decision through Task success and incorrect-action rate.
§ 07
Agree on measurement conditions before publishing a result.
| Measure | Method | Pass condition | Caveat |
|---|---|---|---|
| Task success and incorrect-action rate | Capture page observation as synchronized DOM, accessibility, visual, and network evidence. | Repeated runs satisfy the acceptance threshold agreed during discovery | Demo success is not generalized to reliability on changing live websites. |
| Approval and authority violation detection | Separate read, input, submit, and download authority with approval before irreversible actions. | Repeated runs satisfy the acceptance threshold agreed during discovery | — |
| Run reproducibility and evidence completeness | Separate instructions from external content from user and policy instructions in the execution layer. | Repeated runs satisfy the acceptance threshold agreed during discovery | — |
§ 08
Conditions for not applying the capability are part of the design.
A stable official API performs the same work
Demo success is not generalized to reliability on changing live websites.
Credential isolation and distrust of external content cannot be enforced
Browser authority must not exceed user authority.
§ 09
Proceed through diagnosis, design, and validation gates.
- 01
Diagnosis
PattyAnalyze the current system and its failure signals.
ClientProvide representative work, data boundaries, and operating constraints.
Task success and incorrect-action rate - 02
Design
PattySeparate read, input, submit, and download authority with approval before irreversible actions.
ClientConfirm owners and acceptance criteria.
Approval and authority violation detection - 03
Validation
PattySeparate instructions from external content from user and policy instructions in the execution layer.
ClientMake the production-transition or stop decision.
Run reproducibility and evidence completeness
§ 10
Artifacts remain with the operating organization after the engagement.
- LLM-Native Browser decision record
- Agentic browsing binds observation, action, authority, and evidence into controlled execution—not merely page viewing.Client-owned · Patty-reviewed
- Validation harness and acceptance criteria
- Task success and incorrect-action rate · Approval and authority violation detection · Run reproducibility and evidence completenessJointly maintained
- Operations and recovery runbook
- Demo success is not generalized to reliability on changing live websites. · Browser authority must not exceed user authority.Operating-team owned
§ 11
Use shared terms with explicit operating meaning.
- LLM-Native Browser
- Engineer DOM, accessibility, and visual state with session isolation, tool authority, approvals, and reproducible execution records.
- Acceptance criterion
- Task success and incorrect-action rate
- Operating boundary
- Demo success is not generalized to reliability on changing live websites.
REFERENCES
References and primary material
- W3C WebDriver
Primary material for the method and terminology.
- OWASP LLM Prompt Injection
Primary material for the method and terminology.
Begin by determining whether LLM-Native Browser is the justified next step.
We define scope and validation against representative work, data and infrastructure boundaries, and explicit failure conditions.