Legacy UI agents: approvals before automation

Browser agents make old line-of-business applications automatable again, even where no API exists. AWS presents an approach with Bedrock AgentCore Browser Tool that uses isolated browser sessions, Playwright over CDP, and session recordings. For DACH companies, however, the decisive question is not whether an agent can click. It is: which change may it execute with binding effect, and under what conditions?

Browser access expands the attack surface

An agent that changes policies, enters master data, or prepares bookings works on the same interfaces as employees. It therefore gets access to more than a single tool call: multi-step workflows, session state, and business-critical data. AWS describes separate sessions, IAM controls, and audit trails as architectural building blocks.

That reduces technical risk, but it does not replace a business control model. OWASP notes that external content or inputs can unintentionally influence a language model’s behaviour. Once an agent processes web pages, documents, or free text and then performs actions, its interpretation must not determine authorisation on its own.

Approval is a workflow step, not a prompt

For production browser agents, companies should separate three levels:

• Read and propose: The agent may collect data, prepare cases, and justify a change.
• Prepare: It fills in forms but does not yet save a binding transaction.
• Execute: A transaction with business effect requires explicit approval or a narrowly defined, rule-based exception.

This separation belongs in roles, workflows, and technical permissions. A system prompt can support it, but it is not a reliable access control. OWASP recommends least privilege and human approval for privileged operations; the same principle should apply to browser steps with financial, legal, or personal-data impact.

What to do now

Do not start with the most complex legacy process. Select a case with a clear input, traceable target action, and existing business approval. Log identity, source data, proposed change, confirmation, and outcome. Also define stop rules: an unexpected page, a new data class, missing permission, or divergent validation must hand the case to a person.

The benefit is not replacing RPA with a more autonomous bot. It is deliberately closing manual breaks in legacy processes without losing accountability and evidence. Companies that set these boundaries before the pilot can scale automation while keeping audit, data protection, and business responsibility manageable.