Route consequential form values to a person without exposing raw secrets to the planning model. A compact SMS approval can confirm purpose, scope, destination, expiration, and the exact browser action waiting to continue.
The text message should explain what the browser agent wants to do, where, and why. It should not contain the full card number, password, health identifier, government ID, private message, or customer record being protected.
A strong approval message names the site, action, field category, purpose, amount or consequence, expiration, and what happens after approval. Super fits this pattern because the user can review and reply in the same phone-native channel used for other agent decisions.
Raw secrets, full identifiers, copied private content, session cookies, or values unnecessary for the decision.
Destination, purpose, action, consequence, expiration, reply options, and a human-readable request ID.
The raw value in a scoped secret store available only to the exact browser execution step.
Use a computer-use cache to show a redacted page snapshot and action plan without revealing the protected value.
The text-message AI assistant pattern works best with explicit verbs such as approve once, approve for this site, edit, deny, why, and expire.
Design the path so a delayed, duplicated, or ambiguous reply cannot authorize the wrong browser action.
The browser agent identifies a protected field or consequential action and stops before typing, pasting, submitting, or exposing the value to model-visible context.
State: awaiting approvalBind a unique request ID to the browser session, site origin, field category, action, consequence, redacted evidence, expiration, and one secret-store reference.
State: request sealedText the person a concise summary: “Use saved payment method ending 42 on merchant.example for a $68.20 order? Reply ONCE, DENY, EDIT, or WHY. Expires in 10 minutes.”
State: user notifiedAccept only known verbs tied to the active request. Ask a follow-up when identity, scope, amount, destination, or intent is ambiguous. Ignore stale or duplicate approvals.
State: decision recordedPass the raw value directly from the secret store to the browser tool. The planning model, chat transcript, screenshot replay, and long-term memory receive a stable placeholder.
State: action executedRecord who approved, the exact scope, browser destination, action result, evidence link, secret expiration, whether memory changed, and any repair or rollback path.
State: receipt issuedHover across the outcomes to see how each reply should change browser execution.
Use the secret for this exact action, then expire the execution token.
Allow a defined site or workflow until a clear time or condition.
Change amount, destination, method, field, or action before execution.
Cancel the action, expire the request, and preserve a redacted receipt.
The approval message should contain enough context to make a decision and too little secret data to create a second privacy problem.
Use this list before enabling SMS approvals for payments, identity fields, health information, private communications, or customer records.
The phone identity, browser user, secret owner, and active request refer to the same authorized person.
Approval is bound to the exact HTTPS origin, form, field category, action, and browser session.
Raw values stay outside SMS, model prompts, transcripts, screenshots, logs, and persistent memory.
Requests and secret tokens have short, explicit deadlines and cannot be replayed after closure.
Known verbs map to clear outcomes; ambiguous language triggers clarification instead of execution.
If the browser action feeds an AI website-building workflow, verify that protected fields do not enter drafts, metadata, forms, or deployment logs.
Text approvals are useful because they are immediate, but they still need strict binding and secret isolation.
No. Use a masked description or stable placeholder, such as “saved payment method ending 42,” while the raw value stays in a scoped secret channel.
A bare “yes” is risky when several requests may be active. Prefer explicit verbs tied to a request ID, and clarify when more than one action could match.
Only when the user selects a clearly defined scope with a site, workflow, value category, consequence limit, and expiration. Default to one action.
Invalidate the approval when origin, amount, recipient, field, form, session, or action intent changes, then issue a new decision packet.
Include request ID, user, timestamp, reply, scope, destination, redacted evidence, execution result, expiration, memory impact, and repair path.
Primary guidance for digital identity, AI risk, and agentic application security.
Authentication and authenticator-management guidance relevant to binding user identity and approval channels.
Guidance for governing, mapping, measuring, and managing AI risks.
Security framing relevant to sensitive information disclosure and excessive agency.
A phone-native approval lane can keep consequential browser actions human-controlled without copying sensitive values into model context.