The browser-using agent runs in a sandboxed sidecar and can navigate, read, and interact with web apps on your behalf. Every action goes through the standard human-in-the-loop confirmation gate. The agent can only reach the domains you explicitly add below — even prompt injection cannot widen this list.
One bare hostname per entry. Subdomains are NOT matched — list crm.acme.com and acme.com separately if you need both.