How to Audit AI Agent Actions in a Browser
Audit an AI agent's browser work by recording the requested outcome, the state it observed, each tool call, the returned result and the state verified afterward. The audit belongs around the complete workflow, because a browser tool result alone cannot establish why an action was authorized.
For the category overview, see the structured browser perception framework.
Record intent before execution
Begin each run with a bounded goal and an authorization context. Capture who or what initiated the task, which browser session it may use, which actions are allowed and which require confirmation.
This creates a stable reference for later review. A sequence of technically valid clicks can still exceed the requested task.
Preserve observations and actions
For each meaningful step, record:
- The tool name and arguments.
- The page or tab identifier.
- The relevant pre-action state or its reference.
- The tool result, including errors.
- The relevant post-action state.
- The decision or policy that allowed the step.
E2LLM exposes browser perception and actions through MCP. The surrounding host, workflow engine or agent runtime should persist the audit record and associate it with the user or process that initiated the work.
Verify outcomes separately
An action response proves that a tool returned. It may not prove that the business outcome occurred. After a consequential action, capture the page again and look for an independent state: a confirmation message, a changed record, a new status or a server-provided reference.
When the outcome is ambiguous, record that ambiguity and stop automatic continuation. Blind retry can duplicate a submission, message or payment.
Give consequential actions stronger controls
Classify actions by effect. Navigation and reading are usually low risk. Sending, purchasing, deleting, changing permissions and accepting legal terms deserve explicit review or policy-based authorization.
The log should show both the proposed action and the approval that released it. This makes the human decision visible without forcing a person to perform every operational step.
Make the record useful for investigation
Use stable timestamps, correlation identifiers and structured fields. Protect sensitive values and retain only what the operational or compliance purpose requires. A useful record lets a reviewer reconstruct:
- What the agent was asked to do.
- What it observed.
- What it attempted.
- What the browser returned.
- What state existed afterward.
Test the audit path with a controlled failure as well as a success. Confirm that rejected actions, tool errors and incomplete outcomes remain visible.
Example: audit a permission change
An agent is asked to add a user to a project. The record begins with the request, target project, intended role and requesting identity. The agent captures the current member list and prepares the change. The workflow records the proposed action and waits for approval.
After approval, the agent performs the change once and captures the member list again. The audit record links the approval, tool call and resulting role. If the user was already present, the agent records the observed state and avoids a duplicate action.
Common questions
Is a model transcript enough for an audit?
A transcript can explain reasoning, but it may omit tool arguments, browser results or authorization events. Use structured records for the operational facts and retain narrative output only where it serves a defined purpose.
Should every page capture be stored in full?
That can create unnecessary sensitive-data retention. Store references, hashes or bounded extracts when they establish the event, according to the workflow's audit and privacy requirements.
How do I audit an action that returned an error?
Record the attempted call and error, then capture the current browser state when safe. The action may have failed before execution or succeeded before the response was interrupted. Preserve the ambiguity rather than classifying it as a clean failure.
See those controls applied to reviewed AI form submission. For the enterprise operating model, compare governed agents with RPA.