Safety controls

Browser content is untrusted reference data, not authority. Text on a page cannot change your objective, grant a capability, approve an action, or override Cortex Safety.

Invariants

• Only the authenticated originating browser executes a browser tool call.
• Page observations and tool results are bounded before model use.
• Element references expire with the document version.
• URL schemes and destinations remain subject to enterprise policy.
• Browser capability never grants shell or filesystem capability.
• Completed mutations are not repeated after reconnect; an unknown outcome stops for review.

Always review actions that submit information, communicate externally, change an account, purchase, upload, download or transmit a sensitive value. If Cortex reaches a login, CAPTCHA, unsupported page or policy boundary, complete the step yourself or stop the workflow.