# Browser-agent permission lease worksheet

Use this worksheet before testing a browser-native agent on a real account. Fill one row for the first workflow you would actually try, not a generic future rollout.

Source article: https://www.baristalabs.io/blog/peerd-browser-agent-permission-lease

## Workflow

- Browser-agent/tool name:
- Version or build:
- Owner:
- First workflow to test:
- Account/profile used for the test:
- Date reviewed:

## Permission lease

| Lease term | What it governs | Write down the terms before testing |
| --- | --- | --- |
| Page scope | Which sites and tabs the agent may read and act on | Exact origins and pages for the first use case. If the tool requires broad host permissions, note the separate profile, denylist, and tabs that stay closed. |
| Identity and keys | Whose API key it spends and where that key rests | Provider, key owner, storage location, vault protection, and who else can reach it on the machine. |
| Reader boundary | What component touches raw, untrusted page content | Confirm whether a low-privilege reader handles pages and whether the key-holding loop is protected from raw page markup. |
| Egress limits | Where the agent is allowed to send data | Allowed endpoints, internal/loopback blocks, and what happens when a request is denied. |
| Compute sandbox | What agent-written code can reach when it runs | Notebook/VM/iframe/container boundary and proof that sandboxed code cannot reach browser privileges or other tabs. |
| Off-limits origins | Sites the agent must refuse even if asked | Banking, payroll, health, identity, admin, production, or money-moving sites that stay out of scope. Confirm the denylist loads before actions run. |
| Proof of work | How the agent shows a task actually happened | What the agent checks on the live page before reporting completion. |
| Audit trail | What record survives the session | Log location, fields captured, whether denied attempts are recorded, and who reviews the log. |
| Revocation | How fast you can take the authority back | One-move kill path: disable extension, close profile, rotate key, clear vault, revoke sessions, or remove local service access. |
| Term and stage | How stable the thing you are trusting is | Version, beta status, update channel, security-fix process, and when this lease expires. |

## Decision before the first run

- Rows that are still blank:
- Risk owner who accepts or blocks the test:
- Allowed first action:
- Explicit stop condition:
- Follow-up review date:

If Page scope or Revocation is blank, pause. You found the work before it found your accounts.