Start with an explicit perimeter
A run begins with a base URL and at least one allowed origin. The backend rejects malformed targets, URL credentials, and private or local networks by default. The worker then repeats policy checks for browser requests, redirects, and subresources.
This double validation matters because the browser executes in the worker network, not the user's browser network.
Classify before acting
The explorer separates controls into safe, deferred, blocked, or unsupported categories. Same-origin navigation and low-risk tabs can advance the frontier. Submits, uploads, destructive labels, uncertain forms, purchases, approvals, and external origins do not.
Preserve observations and uncertainty
Page states, screenshots, accessibility snapshots, visible controls, and graph edges record the evidence. Candidate business rules remain reviewable candidates. Authentication barriers and UI drift surface as blocked frontier work rather than fabricated completeness.
Mutation is a separate mode
A bounded sandbox mutation mode exists for trusted users and disposable test data. It is opt-in, serial, audited, and inappropriate for production data. Keeping it separate protects the meaning of the default read-only workflow.