Article reader Listen + reading controls
Article reader
Preparing the reader…
Reading settings
An AI agent needs a jurisdiction, not just a browser¶
Software has spent decades waiting for people to click the buttons. OpenAI's January 23 preview of Operator presents an artificial intelligence agent that can see web pages and act through a browser on a user's behalf.
The interface is new. The organizational question is old: What is this actor allowed to do?
An artificial intelligence (AI) agent that can navigate sites, complete forms, and initiate transactions crosses an important line. It no longer only recommends an action. It enters the workflow and changes external state.
That makes accuracy an incomplete requirement. Even a highly capable agent can choose the wrong account, misunderstand a local exception, accept an unfavorable term, disclose information into the wrong field, or complete an irreversible step before a person realizes the context changed.
Permission is not one thing¶
Most organizations will initially govern agents through access control: which sites, tools, files, and credentials can they reach? That is necessary, but it treats permission as static.
Real authority is conditional. A program analyst may draft a purchase request but not obligate funds. A developer may prepare a deployment but not push to production. A clinician may use a recommendation but remains accountable for the order. Authority depends on purpose, amount, data sensitivity, timing, and consequences.
An agent therefore needs a jurisdiction: a machine-readable description of the actions it may take, the conditions under which it must stop, and the person or role that can authorize an exception. The jurisdiction should be narrower than the technical reach of its credentials.
Design the handoff before the automation¶
OpenAI's preview emphasized user confirmation for certain consequential actions. That is a useful pattern, but a confirmation dialog is not automatically meaningful oversight. Bainbridge's classic “Ironies of Automation” explains the problem: automation can leave people responsible for intervening precisely when their awareness and practice have been reduced.
A good handoff gives the human enough time and context to judge. It should show the agent's goal, the proposed action, the evidence it uses, what will change, which alternatives remain available, and whether the action can be reversed. It should not ask a person to approve a dozen opaque steps simply because policy requires a click.
Start with bounded work¶
The safest early uses are not necessarily the least valuable. They are tasks with clear completion criteria, limited side effects, and recoverable mistakes:
- gather options without purchasing;
- prepare forms without submitting;
- reconcile information and flag discrepancies;
- schedule within predefined windows;
- or draft changes for review in a controlled workspace.
Teams should log actions, retain before-and-after state, test prompt-injection exposure, and provide an immediate stop mechanism. They should also measure how often humans reverse or correct agent actions. Those corrections are not annoyances; they are evidence about where the jurisdiction is poorly drawn.
The arrival of browser-using agents does not remove process. It turns process into part of the software. Organizations that make authority, escalation, and recovery explicit will be able to delegate more safely. Organizations that give an agent a credential and a goal will discover that access is not the same as permission—and autonomy is not the same as accountability.
Sources and research trail¶
- OpenAI, “Introducing Operator” (January 23, 2025).
- Bainbridge, “Ironies of Automation” (1983).
- Parasuraman, Sheridan, and Wickens, “A Model for Types and Levels of Human Interaction with Automation” (2000).
- Amershi and colleagues, “Guidelines for Human-AI Interaction” (2019).