I sat in a room with a very large automation system and a very familiar problem: it had become fragile.
The language came quickly. DOM. Timestamps. Timing windows. Selectors. Retries. Circle back.
Every word was reasonable.
Together, they described a hill.
The system was not fragile because its builders lacked discipline. It was fragile because the path had become the product. A bot was taught not what outcome had to be true, but which element to find, where to click, how long to wait, and what to retry when the page disagreed. Each workaround made sense locally. Together, they turned change into maintenance.
The first proof
The first proof on my machine was 636 bytes.
Not the model. Not the browser. Not the platform around it. It was a WebAssembly module: a tiny, portable program injected at the boundary between an intelligent proposal and an authorized browser action. Its smallness mattered because it kept that boundary deterministic, inspectable, and difficult to hide complexity inside.
It does not do everything. That is the point.
The 636-byte module is the injected proof; the hardened Rust kernel in this build compiles to 26,893 bytes. Neither contains the model, scheduler, credential store, policy engine, or evidence system. Those responsibilities live outside the browser boundary, where they can be isolated, governed, and replaced independently. Small is not the absence of an architecture. Small is a decision about where complexity is allowed to live.
Intelligence is not authority
An AI model can interpret an intent, inspect the current page, and propose what should happen next. It cannot grant itself permission. It does not get to cross a tenant, workspace, or origin boundary because doing so would be convenient. It does not receive a credential or press a consequential button merely because its reasoning sounds confident. Those decisions belong to local policy and the execution layer. Intelligence stays flexible; authority stays bounded.
That separation becomes a lifecycle:
intent → lease → observe → decide → act → verify → artifact
The intent defines the outcome. A lease gives one worker a short-lived claim on that work. The worker observes the page, the reasoning layer proposes a decision, and policy determines whether an action may execute. Verification checks the resulting state rather than trusting the click. Finally, an artifact preserves causally linked evidence of what happened. Every arrow is a boundary where the system can refuse, recover, or explain itself.
The hill has a bill
The hill also has a bill. To make that friction visible, I ran an illustrative planning scenario through agent-calc—not customer telemetry. Assume 100 workflows, two changes per workflow each month, four maintenance hours per change, and fully loaded labor at $140 per hour. The modeled comparison is stark:
| Scenario | Modeled monthly cost |
|---|---|
| Legacy path maintenance | $112,000 |
| Intent architecture | $20,098 |
| Avoided friction | $91,902 |
That is an 82.1% modeled reduction. The percentage is not a promise; the assumptions are visible precisely so they can be challenged. The useful question is what the model exposes: how much are we spending to preserve instructions that describe yesterday's interface instead of today's desired outcome?
Test the outcome
Of course, an architecture that survives only a curated demo is just a cheaper failure. So we built the Component Gym: a synthetic web application designed to resist memorization. Controls move between runs. Buttons use different event listeners. The target may be buried among decoys inside randomized tabs and paginated lists. A seed makes each hostile arrangement reproducible without making it predictable to the agent.
The agent receives an intent, not a selector script. The harness then grades the resulting application state out of band. It does not care which path looked convincing or whether a click event fired. It cares whether the requested outcome became true.
In the filmed run, seed 710003 placed the needle inside a dynamic collection spread across tabs and pages. The agent was given the desired outcome and the browser's current state—not the target's coordinates or a prerecorded route. It had to navigate, distinguish the target from decoys, act, and leave the requested state behind. Only then did the independent grader return PASSED. The agent did not get to grade its own homework.
Determinism moved
None of this makes the DOM, timing, or selectors disappear. The browser still has structure. Events still happen in time. A selector may still be the right tactic for a particular action. What changes is their lifetime and ownership. In a path-driven system, those details harden into durable business logic. Here, they are runtime observations and disposable tactics, abandoned when the environment changes. Determinism has not been removed; it has been relocated into authorization, state transitions, verification, and evidence.
A primitive is not a platform
A passing gym run proves the primitive, not the platform. The small browser boundary reduces one category of fragility; it does not erase the distributed-systems, security, and operational work around it. The remaining obligations are less cinematic and more important:
- Isolation: preserve tenant, workspace, worker-claim, and origin boundaries through every action.
- Work ownership: make leases expire safely, recover interrupted work, and prevent retries from duplicating consequential actions.
- Secrets and MFA: resolve credentials only at the authorized execution boundary, never inside model context, jobs, logs, screenshots, videos, or artifacts. MFA is on-behalf execution, never authentication bypass.
- Browser lifecycle: attach to, control, recover, and release browser sessions without leaking state between workers or tenants.
- Policy: deny actions that exceed the granted intent, even when the proposed action is technically possible.
- Evidence: causally connect intent, observation, decision, authorization, action, verification, and artifact so a result can be explained after the browser is gone.
Compile the boundary smaller
The 636 bytes are not interesting because smaller software is automatically better. They are interesting because they make a refusal physical: do not bury orchestration, secrets, and authority inside the thing touching the page. Compile the trusted browser boundary smaller. Let reasoning adapt to the environment around it. Demand proof after every meaningful consequence.
I keep returning to that room. No one in it said anything absurd. The hill was built from rational decisions made under one inherited premise: the path must be preserved. Change that premise and the hill changes shape. We do not need to keep teaching automation every route through an interface. We can preserve the intent, rediscover the route, constrain the action, and verify the destination.
The next time an automation breaks and asks for another selector, timeout, or recovery layer, ask one question first: how much of this system protects the outcome—and how much protects yesterday's route?
