Play / The map / The products / Browser extension — all sites

A browser extension with broad host permissions

Not an agent by name, and it has a grant: an extension granted 'read and change all your data on all websites' reads every page you visit, reaches any host, and acts inside the sites you are logged into. Nobody wrote it a mandate. DERIVED from the permission model the browser documents; not measured on any instance.

generic · surface extension · variant broad-host-permissions · profile version 2026-09-05 · reaches 3 of 23 capabilities, 3 of which cannot be undone. Edit this profile · the file.

CapabilityUndo Browser extensionall sites
filesystem — files and directories
Read the project it is working onread.file.projectyes ·
Change the project it is working onwrite.file.projectwith-effort ·
Read any file the account can reachread.file.hostno ·
Change any file the account can reachwrite.file.hostwith-effort ·
Delete files anywhere the account can reachdelete.file.hostno ·
Read a retained record: shell history, past sessionsread.record.historyno ·
process — programs and their execution
Run programs as the accountexecute.process.hostwith-effort ·
Run programs inside its own sandbox onlyexecute.process.selfyes ·
network — endpoints and hosts
Reach a permitted list of hostssend.endpoint.allowedno ·
Reach any host on the internetsend.endpoint.worldno
identity — credentials and who the agent can act as
Read credentials stored where it runsread.credential.hostno ·
Act in accounts with the credentials it holdsauthenticate-as.credential.tenantno
Change its own permission settingsgrant.credential.selfyes ·
communication — messages to people
Send a message to anyonesend.message.worldno ·
Read mail or chat it is connected toread.message.tenantno ·
code — repositories and what lands in them
Commit to the repository it was pointed atwrite.repository.projectwith-effort ·
Push to a code host (any branch it can reach)write.repository.tenantwith-effort ·
Sign commits with the key it holdsauthenticate-as.credential.signingno ·
Publish packages, images or pages under the name it holdscreate.record.worldno ·
money — budgets and spend
Spend money or tokens against an account it holdswrite.budget.tenantno ·
schedule — things that outlive the turn
Create something that outlives the turn where it runs (a cron, a service)create.schedule.hostyes ·
Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session)create.schedule.tenantyes ·
browser — what a browser extension or automation can see and do in your browser
Read every page you visitread.record.browsingno

What host, tenant and world mean here

ReachHere, it means
hostyour browser — every page, every logged-in site
tenantthe sites you are logged into, as you
worldthe internet, from your browser

What it cannot reach, and why

WhatWhySource
files on your diskthe browser sandbox; an extension reads pages, not the filesystemthe browser's extension permission model

The grant, tool by tool

Two tools in one session reach different things, which is why the unit of mapping is the tool and not the product. Each row carries the control on the path and the tier of evidence behind it.

the extension

CapabilityControlEvidenceWhat is on the path
Read every page you visit read.record.browsing● nonedocumented— · 'read and change all your data on all websites'
Reach any host on the internet send.endpoint.world● nonedocumented— · host permissions
Act in accounts with the credentials it holds authenticate-as.credential.tenant◐ settingdocumentedthe site's own session controls · acts inside sites where you have a session, as you

What narrows it

For each capability in the grant: the specific setting or arrangement that narrows it, what it costs, and the tier the control reaches afterwards. Guidance is free and stays free.

CapabilityThe settingWhat it costsTier after
Act in accounts with the credentials it holdsscoped, short-lived tokens issued to the agent rather than your own; read-only where read is all it needsan hour per service, and rotationboundary
Read every page you visitgrant the extension access on click, or on a list of sites, instead of on all sites; remove the ones you do not usea click the first time on each siteboundary
Reach any host on the internetroute outbound traffic through an allow-list — the one control the hosted container already has, demonstrated rather than claimedan hour, if you already have somewhere to put itboundary

Against the mandates

What a reasonable person wanted from this setup, and the gap: ▲ excess is what it can do that they did not want; ▼ shortfall is what they wanted that it cannot do.

MandateExcessShortfall
A browser extension I installed▲ 2▼ 0

Sources

A derived row is an inference from what this kind of program architecturally is. It is a claim, and the most useful pull request on this page is one that replaces a claim with a probe run — how.