AI Agent Safety Belongs in the Environment, Not the Agent's Own Judgment

A developer building a browser-based AI agent argues that the standard 'can this be undone?' safety check is flawed, proposing 'reach' — how far damage could spread if the agent is wrong — as a better measure. The core problem is that an agent cannot assess its own blast radius because it lacks context, such as not knowing an email list has 50,000 recipients. In a browser, risk is compounded because the agent inherits all active sessions, meaning the same action can be harmless on one site and irreversible on another. The developer's solution moves safety controls into the environment itself: credential fields are stripped from the page before the agent sees them, structurally sensitive controls always trigger human confirmation regardless of the agent's assessment, and a timeout counts as a denial rather than a pause. One unsolved challenge remains — how to let users resume a denied task later when the underlying page state may have already changed.