Before You Hand Over the Mouse: A Team Charter for AI That Clicks

There is a moment, somewhere in the first week of using an agentic browser, when you stop watching it work. The cursor moves on its own, a form fills, a confirmation page loads, and you look away to answer a message. That's the moment worth designing for, because it's the one where nobody is quite sure who agreed to what.

Agentic browsing has moved from demo videos into ordinary working life. Chrome, Edge and a lengthening list of standalone assistants can now hold a session, navigate a supplier portal, compare prices, and complete a checkout. For a UK professional with twelve tabs and a train to book, that is genuinely useful. It is also a new category of risk that most team policies haven't caught up with — because the tool isn't just reading, it's acting.

Why 'just let it handle it' is the wrong default

Traditional software waits for instruction. An agent interprets a goal — "sort out the team's rail travel for the Leeds offsite" — and then makes a series of decisions on the way. Some of those decisions are trivial (which site to open). Some are not (which fare class, which card, whether to accept the optional insurance.

The trouble is that the interesting choices are invisible until they're done. A booking confirmation doesn't explain why it picked the flexible ticket. A subscription renewal doesn't tell you the agent read "keep the team tools running" generously. By the time you notice, the money has left and the account has changed.

This isn't an argument against agents. It's an argument for a permission slip — a short, agreed document that says what the agent may decide alone, what it must ask about, and what it may never touch. Onboarding tends to skip this, so teams end up improvising the rules mid-flight. Better to write them down while everyone is calm.

Clause one: the boundaries of the account

Start with identity rather than money. Which logins is the agent allowed to hold at all?

A workable rule is a dedicated identity — a named workspace account, or at minimum a role-based address — rather than an agent quietly riding on a director's personal login. If something goes sideways, you want to revoke one credential and know exactly what it could reach, not untangle six months of shared sessions.

Then draw a line around the sensitive stuff. Business banking, payroll, HMRC's online services, Companies House filings, anything touching client personal data: these should sit outside the agent's reach entirely, at least until you've watched it behave for a quarter. The same goes for email — an agent with a live inbox can reset its own passwords, which quietly undoes every other boundary you've set.

• Permitted: supplier portals, travel booking, parcel tracking, read-only research, form-filling on low-risk sites.
• Ask first: anything that creates a recurring charge, changes an address, or accepts terms and conditions on the company's behalf.
• Off limits: banking, payroll, identity verification, email, and any site holding customer records.

Clause two: payment limits that mean something

"Reasonable spending" is not a limit. It's a hope. Put numbers on it.

Many UK finance teams now issue single-use virtual cards for exactly this purpose, and they're well suited to agent work: a ceiling per transaction, a monthly cap, and a card that dies after the job is done. If the agent goes on a spree, it hits a wall rather than a fraud investigation.

As a rough starting point for a small team, something in the region of a £50 per-transaction limit with a £250 monthly cap keeps the agent useful for bookings and small renewals while stopping anything dramatic. Agree it in writing, and review it after a month of real use. Note the obvious exclusions too: no saved cards in the browser vault, no automatic top-ups, no purchases in currencies you haven't named.

Clause three: the approval step that actually gets used

Human-in-the-loop sounds reassuring until you realise the human approves everything at 4:55pm on a Friday without reading it. Approval works when it's narrow and rare.

A practical pattern is a two-key rule: the agent may act freely below the threshold, and above it must present a summary — what it's about to do, on which site, for how much — for a click. Keep that summary to three lines and make it unavoidable. If the confirmation is buried in a chat log, it will be rubber-stamped.

There's a second approval worth having: the irreversible-action gate. Cancellations, contract acceptances, address changes and anything that deletes data should never be one-click. Ask for those to be handed back to a person entirely, at least for the first few months.

Clause four: the activity log nobody has to reconstruct

An agent's usefulness and its auditability are the same thing. If you can't see what it did, you can't trust it with anything more.

Insist on a weekly export: a list of sessions, sites visited, actions taken, amounts spent. Screenshots of confirmations are worth keeping for anything financial — they're the difference between "the supplier says we cancelled" and proof. Storing these in a shared folder, alongside the team's other records, means the review takes ten minutes rather than an afternoon of archaeology.

The log also does something subtler. Once people know the week gets reviewed, they read the summary before approving. It turns a rubber stamp into a habit.

Clause five: an exit that works

Finally, write down how you switch it off. Revoke the agent's credentials, kill the virtual card, remove stored sessions, and check the connected-apps list in each service it touched. Bear in mind the UK GDPR expectation that you can account for what a processor did with personal data on your behalf — an agent acting in your name is not a get-out clause.

Do this on the last Friday of the month as a five-minute drill, so nobody learns the procedure for the first time during an incident.

The one-page version

If you write nothing else, write this and pin it somewhere the team can see it: which accounts the agent may hold, the per-transaction and monthly caps, the sites it may never touch, the two triggers that always need a human click, who reviews the log and when, and how to revoke access in under ten minutes.

Agentic browsing rewards a bit of preparation. The tools will keep getting better at clicking. The judgement about what's worth clicking is still ours — and a permission slip is how you make sure it stays that way.