What an agent-native browser should own

If an agent can act inside a browser, who should remember what it is allowed to do?

The model could remember. The application that connected it could remember. A chat panel could keep a list somewhere. All three answers work until the model changes, another client connects, or the user takes control of the tab.

The browser is the only part of this system that sees the whole situation. It knows which tabs exist, which page is visible, which connection asked for an action, whether the action is sensitive, and whether the person has started using the page again.

I kept running into this while building Narada. The model could finish a turn, but the browser still had to decide what was in scope, what needed approval, and whether the person had taken the tab back. I think the browser has to own those rules.

That is the product model behind Narada. It is not a browser with an agent bolted onto the side. The browser is the control plane for agents acting on a person’s behalf.

So in Narada the browser owns that interface. An external agent can connect to it. The first-party Agent Host uses the same path from inside the app. The model can change. The client can change. The rules around the browser do not have to move with them.

Those rules begin with scope. A connection is granted particular tabs, not silent access to everything open in the browser. Actions appear in browser activity. Sensitive actions stop for approval. If the user starts interacting with a tab, that is not noise for the agent to ignore. It is a change in authority.

Take over is only one of those moments. Sensitive actions pause the same way: the browser waits for a person, not for the model to invent permission.

The result of an action matters too. “I clicked it” is not enough. The browser should report whether the document changed, navigation happened, a value was filled, or nothing happened at all. That gives the agent a basis for continuing, recovering, or stopping.

There is an obvious objection here. Does making the browser agent-aware mean giving the agent more control over the person using it?

It should mean the opposite.

An agent can work in a granted tab without constantly taking over the visible browser. The user can choose to follow its actions, take over, cancel the task, or refuse an approval. The browser keeps those choices because they belong to the person, not to whichever model happens to be running.

Models will keep changing. So will the clients that call them. Identity, scope, approvals, activity, and user control are browser responsibilities. They need a stable home.

If you want to follow the product itself, not only these notes, Narada lives at narada.koley.in.