Where the agent runs decides whose guardrails apply

Accountability, in this framing, is an inventory of controls. With an on-site agent the column says you choose the model, define the guardrails, and decide the tone, the escalation paths and exactly what the agent is and is not allowed to promise a customer ^[12]. With an off-browser agent the list runs the other way: a model you did not choose, guardrails you did not write, and your brand represented in a conversation you cannot see ^[5]. In-browser is described as a better deal, because a human is watching the same screen and can catch a mistake before it lands, while the model, the tone and the decision logic stay outside your hands ^[10].

The co-browsing path is where the mechanism is easiest to see. An extension can act inside a user's already authenticated session without requiring any special integration on the site's side ^[11]. Nothing in that flow asks the site to agree. "But an agent you do not control is still speaking for your business," the author wrote ^[6].

The liability claim itself is stated as a possibility. If an outside agent misquotes a price, misstates a policy or initiates a transaction that creates a customer dispute, then according to the column "the fact that the agent belonged to somebody else may not make the resulting problem disappear" ^[7]. The security half of the case is sourced to two documents. Anthropic's guidance for browser and computer-use agents notes that webpages and application interfaces can contain adversarial instructions, and recommends scoped permissions, human confirmation for high-stakes actions and monitoring of agent behavior ^[8]. OWASP's AI Agent Security Cheat Sheet lists prompt injection, tool abuse and privilege escalation, data exfiltration and memory poisoning ^[9].

The precedent the column draws is the strongest part of the argument. Enterprises did not expose databases directly to the internet; they introduced APIs, and APIs brought contracts, authentication, auditing and policy enforcement ^[14]. The equivalent for agents is exposing governed capabilities through tools with explicit contracts ^[15]. A tool contract governs which call is permitted. What the agent then says to the customer comes from the model and the prompt, and those are what the on-site home lets you pick ^[12].

The published-action idea helps both sides. The column's description of WebMCP is a site publishing actions that an agent can invoke, and it does not say whose agent ^[16]. A documented, callable action removes the guessing for your own on-site agent, and it removes the same guessing for the roaming one.

Whether the recommendation transfers depends on the two conditions the column sets for it: real compliance exposure, or a brand you cannot afford to have misrepresented ^[4]. The column credits off-browser agents with real reach, comparing your prices against every competitor and continuing to work after your support team has gone home ^[17]. On-site restores something concrete in return: direct access to your systems, so the agent does not have to reverse-engineer your checkout flow, and it can be given your actual domain knowledge and your actual APIs ^[13]. There is no figure in the piece for what the on-site build costs, and none for how often an outside agent gets a price or a policy wrong.