# Agents Acting Safely on Our Behalf

## Executive summary

The future of the web requires changing the web for agents, rather than solely relying on making agents smarter. The core technical solution discussed is WebMCP (Web Manifest Content Protocol), an API that allows site builders to define specific, deterministic actions for agents. This approach enhances security by allowing developers to annotate content (e.g., marking user-generated content as `readon`) and implementing consequential hints, ensuring agents do not operate non-deterministically by merely scraping the DOM or accessibility tree. Security requires multi-layer defenses, including agent containment, origin sets, and spotlighting.

## Key takeaways

- WebMCP is the preferred path for agent integration.: While agents are changing the web, the consensus is that the web must adapt. WebMCP offers an elegant API to specify exact agent actions, complementing existing protocols like REST and GraphQL, rather than replacing them. It allows for chained actions (e.g., `webmc` -> `mcp` -> `webmc`).
- Agent experiences must be tailored and secure.: The ideal web experience is not limited to a single modality (e.g., pure agent use or pure human interaction). Developers must design for varying user appetites for agents, ensuring security and privacy through multi-layer strategies.
- Security requires multi-layer defensive strategies.: To protect against non-deterministic agent behavior, recommended strategies include: **Special agent containment** (limiting scope, e.g., only five sites, or a $20 spending limit); **Origin sets** (restricting data sources to specific domains); and **Spotlighting** (giving greater weight to user-defined critical context within a large context window).
- Strategic engineering requires 'thought experiments'.: To identify high-impact business problems, senior engineers should use thought experiments (like 'premortems') and apply deep empathy for users and site builders (e.g., considering HIPAA or attorney-client privilege requirements) to guide technical development.

## Technical details

- WebMCP Protocol: WebMCP provides a deterministic surface area for agents, allowing developers to specify exact actions. It supports annotations (e.g., `readon` for user-generated content) to help agents distinguish between trustworthy and ephemeral web data, mitigating risks like prompt injection attacks.
- Agent Modalities: Agents can operate in various modes: **Computer-use apps** (headless, set-it-and-forget-it); **Browser-use agents**; **Co-browsing** (human-in-the-loop); and **Task-specific involvement** (where the user is intrinsically part of the process).
- Security Mechanisms: Defensive strategies include: **Agent Containment** (defining strict boundaries for agent access); **Origin Sets** (limiting data sources to specific domains); and **Spotlighting** (elevating the importance of user-defined context within LLM context windows).
- Development Workflow: WebMCP is designed to be additive, complementing existing APIs like REST and GraphQL. The goal is to enable developers to opt-in easily, potentially through tooling that analyzes the DOM, though WebMCP remains the ideal long-term solution.

## Practical implications

- Site builders should prioritize implementing WebMCP to provide a secure, deterministic interface for AI agents.
- Developers should design user experiences that accommodate multiple agent modalities, from fully automated background tasks to highly interactive co-browsing.
- Security architecture must adopt a multi-layered approach, moving beyond simple authentication to include scope and origin restrictions for agents.

## Topics

Agentic Web, WebMCP, AI Security, LLM Integration, Software Architecture, UX Design, MLOps Community, Sarah Drasner

Source: https://www.youtube.com/watch?v=mNY62rPQpUE