LLM-Native Browser
Agentic browsing binds observation, action, authority, and evidence into controlled execution—not merely page viewing.
Engineer DOM, accessibility, and visual state with session isolation, tool authority, approvals, and reproducible execution records.
01
Problem definition
On dynamic pages, divergence between model observation and click target can record incorrect actions as successful.
A browser mixing cookies, credentials, and external input becomes a boundary for prompt injection and authority misuse.
- Human web workflows without APIs must be automated audibly
- Pre-action approval and result evidence must be preserved at each step
- A stable official API performs the same work
- Credential isolation and distrust of external content cannot be enforced
LLM-Native Browser: system plate
- 01
State 1
Capture page observation as synchronized DOM, accessibility, visual, and network evidence.
- 02
State 2
Separate read, input, submit, and download authority with approval before irreversible actions.
- 03
State 3
Separate instructions from external content from user and policy instructions in the execution layer.
- 04
State 4
Retain pre/post-action state and failure causes in an event log and replayable run bundle.
FEEDBACKFailed acceptance returns evidence to the first controlled stage: Task success and incorrect-action rate.
- The workflow begins with Capture page observation as synchronized DOM, accessibility, visual, and network evidence..
- It reaches an acceptance decision through Task success and incorrect-action rate.
03
Design method
Agentic browsing binds observation, action, authority, and evidence into controlled execution—not merely page viewing.
- 01
Stage 1
Capture page observation as synchronized DOM, accessibility, visual, and network evidence.
- 02
Stage 2
Separate read, input, submit, and download authority with approval before irreversible actions.
- 03
Stage 3
Separate instructions from external content from user and policy instructions in the execution layer.
- 04
Stage 4
Retain pre/post-action state and failure causes in an event log and replayable run bundle.
04
Application scenarios
Human web workflows without APIs must be automated audibly
On dynamic pages, divergence between model observation and click target can record incorrect actions as successful.
- APPROACH
- Capture page observation as synchronized DOM, accessibility, visual, and network evidence.
- BOUNDARY
- Demo success is not generalized to reliability on changing live websites.
Pre-action approval and result evidence must be preserved at each step
A browser mixing cookies, credentials, and external input becomes a boundary for prompt injection and authority misuse.
- APPROACH
- Separate read, input, submit, and download authority with approval before irreversible actions.
- BOUNDARY
- Browser authority must not exceed user authority.
05
Design choices
| Decision | Gain | Cost | Watch |
|---|---|---|---|
| Human web workflows without APIs must be automated audibly | Capture page observation as synchronized DOM, accessibility, visual, and network evidence. | Demo success is not generalized to reliability on changing live websites. | Task success and incorrect-action rate |
| Pre-action approval and result evidence must be preserved at each step | Separate read, input, submit, and download authority with approval before irreversible actions. | Browser authority must not exceed user authority. | Approval and authority violation detection |
LLM-Native Browser: system plate
- On dynamic pages, divergence between model observation and click target can record incorrect actions as successful.
- Demo success is not generalized to reliability on changing live websites.
- Separate read, input, submit, and download authority with approval before irreversible actions.
- Task success and incorrect-action rate
- Run reproducibility and evidence completeness
- Browser authority must not exceed user authority.
- The workflow begins with Capture page observation as synchronized DOM, accessibility, visual, and network evidence..
- It reaches an acceptance decision through Task success and incorrect-action rate.
07
Validation plan
| Measure | Method | Pass condition | Caveat |
|---|---|---|---|
| Task success and incorrect-action rate | Capture page observation as synchronized DOM, accessibility, visual, and network evidence. | Repeated runs satisfy the acceptance threshold agreed during discovery | Demo success is not generalized to reliability on changing live websites. |
| Approval and authority violation detection | Separate read, input, submit, and download authority with approval before irreversible actions. | Repeated runs satisfy the acceptance threshold agreed during discovery | — |
| Run reproducibility and evidence completeness | Separate instructions from external content from user and policy instructions in the execution layer. | Repeated runs satisfy the acceptance threshold agreed during discovery | — |
08
Constraints and failure conditions
A stable official API performs the same work
Demo success is not generalized to reliability on changing live websites.
Credential isolation and distrust of external content cannot be enforced
Browser authority must not exceed user authority.
09
Engagement model
- 01
Diagnosis
PattyAnalyze the current system and its failure signals.
ClientProvide representative work, data boundaries, and operating constraints.
Task success and incorrect-action rate - 02
Design
PattySeparate read, input, submit, and download authority with approval before irreversible actions.
ClientConfirm owners and acceptance criteria.
Approval and authority violation detection - 03
Validation
PattySeparate instructions from external content from user and policy instructions in the execution layer.
ClientMake the production-transition or stop decision.
Run reproducibility and evidence completeness
10
Durable deliverables
- LLM-Native Browser decision record
- Agentic browsing binds observation, action, authority, and evidence into controlled execution—not merely page viewing.Client-owned · Patty-reviewed
- Validation harness and acceptance criteria
- Task success and incorrect-action rate · Approval and authority violation detection · Run reproducibility and evidence completenessJointly maintained
- Operations and recovery runbook
- Demo success is not generalized to reliability on changing live websites. · Browser authority must not exceed user authority.Operating-team owned
11
Terminology
- LLM-Native Browser
- Engineer DOM, accessibility, and visual state with session isolation, tool authority, approvals, and reproducible execution records.
- Acceptance criterion
- Task success and incorrect-action rate
- Operating boundary
- Demo success is not generalized to reliability on changing live websites.
REFERENCES
References and primary material
- W3C WebDriver
Primary material for the method and terminology.
- OWASP LLM Prompt Injection
Primary material for the method and terminology.