# Agents Acting Safely on Our Behalf

Sarah Drasner, Google | AGNTCon + MCPCon North America 2026 | 23:06
Hosted by Demetrios Brinkmann

Source: https://www.youtube.com/watch?v=mNY62rPQpUE
Channel: MLOps Community, now AAIF Live (https://www.youtube.com/@AAIFLive-x1r). Summarised by MLOps Talks.
Page: https://mlopstalks.com/talks/agents-acting-safely-on-our-behalf
Published: 2026-10-15
Tags: guardrails, human-in-the-loop, mcp, tool-use

## TL;DR
- The web should expose explicit, annotated actions for agents instead of leaving them to scrape pages and act through the DOM.
- People should be able to choose how much control an agent has, with limits on sites, data, spending, and context.
- WebMCP can work alongside REST, GraphQL, and MCP, while batch actions can reduce repetitive work and improve accessibility.

## Summary
Sarah Drasner argues that the web should change so agents can use it through explicit actions rather than screenshots, accessibility trees, and unpredictable DOM scraping. WebMCP can define those actions and annotate user-generated content or consequential operations, giving agents signals about what they can trust and when they must ask the user to confirm. She describes several layers of protection, including restricted agent identities, approved site groups, spending limits, and priority signals in the context window. The conversation also covers different levels of human involvement, from fully automated computer use to collaborative browsing. Sarah explains that WebMCP grew from work involving Microsoft Edge and Google, and that DOM-analysis gateways may help during adoption but do not capture application state well. She also describes practical tools for batch tasks, such as carrying unfinished to-dos into the next day or adding frequently ordered items to a shopping cart.

## Key ideas
### The web needs explicit agent actions instead of uncontrolled scraping
[01:23](https://www.youtube.com/watch?v=mNY62rPQpUE&t=83s)
Sarah says the web should expose the actions an agent is allowed to take. WebMCP can annotate actions as read-only or identify content created by users, giving the agent a signal not to act on potentially untrusted comments or other page content. A consequential hint can tell the agent to return to the user for confirmation before an important operation. Without this surface, agents scrape the DOM, accessibility tree, or screenshots, which Sarah calls slower, token-inefficient, and non-deterministic. Explicit actions give developers a more predictable way to guide agent behaviour.

### Agents need different levels of human involvement
[03:37](https://www.youtube.com/watch?v=mNY62rPQpUE&t=217s)
Sarah describes several ways people may use agents. A person might let a headless computer-use agent run on its own, collaborate with an agent in a co-browsing session, or switch between doing a task personally and delegating only repetitive parts. Her holiday example separates researching suitable TripAdvisor options from purchasing an airline ticket and choosing seats. She says people have different appetites for agent control, so the web needs to support users who want automation as well as users who want to remain closely involved.

### Agent permissions should be limited across several layers
[07:35](https://www.youtube.com/watch?v=mNY62rPQpUE&t=455s)
Sarah says no single control will secure the web because agents are non-deterministic. She describes an agent identity with narrower access than the human owner, such as permission to visit only five sites or spend no more than $20 in a month. Origin sets can restrict a trip-planning agent to sites such as Expedia and United, keeping it away from banking or health sites. Spotlighting can give user-selected information more weight inside a large context window. These controls define what data, destinations, and actions an agent can use.

### Senior engineering work requires moving between strategy and implementation
[09:30](https://www.youtube.com/watch?v=mNY62rPQpUE&t=570s)
As an area tech lead at Google, Sarah has to work across the AI and web ecosystem while still going deep into technical problems. She deliberately steps back from tactical details and writes papers from a higher-level view. One technique is a premortem that asks how the web could fail in five years, then works backward to find ways to prevent those outcomes. She also considers the needs of people such as doctors and lawyers who have privacy obligations. This process helps her turn broad concerns into concrete technical work, including easier WebMCP adoption.

### Thought experiments help sort competing priorities
[13:33](https://www.youtube.com/watch?v=mNY62rPQpUE&t=813s)
Sarah says strategic decisions require time to read documents, inspect implementations, and validate that technical work matches the story presented in plans and slides. At Google, docs and slides are central to communication, so she sets aside focused time each week to process them. She checks whether a stated strategy is actually reflected in the implementation across teams. Her approach combines broad thought experiments with enough technical inspection to see whether a proposed direction is real and workable.

### WebMCP came from cross-company work involving Microsoft Edge and Google
[15:29](https://www.youtube.com/watch?v=mNY62rPQpUE&t=929s)
Sarah says she joined her current role in April and was not present for the entire history of the specification. As she understands it, the idea began with Alex Nahas at Microsoft and Edge, which worked on the specification proposal before Google became more involved. She describes WebMCP as a cross-team and cross-system collaboration. Her own previous role covered Google core infrastructure, including web, Android, iOS, multiplatform experimentation, observability, and reliability.

### DOM-based gateways can help adoption while still missing application state
[17:31](https://www.youtube.com/watch?v=mNY62rPQpUE&t=1051s)
Sarah rejects the idea that one site owner can create a WebMCP implementation for every other website. She says easier adoption could come from support in React and Vue, perhaps through a package configuration change, or from a tool that analyses an existing DOM. That analysis could be a useful temporary measure for sites without a WebMCP implementation, but the DOM does not contain the full state of an application. She therefore expects site builders to adopt WebMCP directly over time.

### WebMCP can connect with existing APIs and support new batch actions
[19:01](https://www.youtube.com/watch?v=mNY62rPQpUE&t=1141s)
Sarah says WebMCP does not replace MCP, REST, or GraphQL. Existing client-side states and actions can be exposed through WebMCP while the implementation continues to use those systems underneath. She describes tools that go beyond exposing individual actions, such as carrying unfinished to-dos into the next day and starting a journal entry, or adding items ordered more than ten times to a shopping cart. She connects these batch actions with accessibility and with reducing work for busy users.

## Notable quotes
- Sarah Drasner: "No, we should be changing the web for agents." (01:34)
- Sarah Drasner: "We have to use multi-layer defensive strategies because agents can be non-deterministic and they can do all sorts of things." (07:35)
- Sarah Drasner: "I always have to bump myself up a level to also see things from a higher purview." (10:32)
- Sarah Drasner: "It works, but it's not what you want to have working." (18:43)
- Sarah Drasner: "It's an opportunity to delight the customer in ways that they weren't expecting." (22:46)

## Tools & references mentioned
- WebMCP
- React
- Vue
- Canva
- Flickr
- Google
- Chrome
- Microsoft
- Edge
- Alex Nahas
- MCP
- REST
- GraphQL
- Gemini
- TripAdvisor
- Expedia
- United
- Google Maps
- Agent Con
- MCPCon

## Who should watch
- You are building agents that browse websites and need to decide when an agent should act alone or ask the user.
- Your product has sensitive data, spending permissions, or consequential actions that need more than a single safety control.
- You maintain a web application and want to expose agent actions without throwing away existing React, Vue, REST, GraphQL, or MCP infrastructure.

## Related talks

- [Responsible Autonomy: Building Governance Frameworks for AI That Act in the Real World via MCP](https://mlopstalks.com/talks/responsible-autonomy-building-governance-frameworks-for-ai-that-act-in-the-real) (Saurabh Mishra, Optum, 27:55)
- [AI Agents Are About to Get Real, Here's Why It Matters](https://mlopstalks.com/talks/ai-agents-are-about-to-get-real-heres-why-it-matters) (Sam Partee, Arcade AI, 13:20)
- [MCP is not going to change everything (yet)](https://mlopstalks.com/talks/mcp-is-not-going-to-change-everything-yet) (Sam Partee, Arcade AI & Rahul Parundekar, AI Hero, 1:04:43)
- [Enterprise-ready MCP](https://mlopstalks.com/talks/enterprise-ready-mcp) (Jiquan Ngiam, MintMCP, 28:36)
- [Web Agents: The Cutting Edge of AI is Here?](https://mlopstalks.com/talks/web-agents-the-cutting-edge-of-ai-is-here) (Paul van der Boor & Chiara Caratelli, Prosus Group, 45:53)