When an agent rides on the customer’s own browser session, the brand often cannot tell whether a human or an agent is acting. That makes it hard to apply agent-specific limits, auditing, or revocation. It also blurs accountability if the agent exceeds intended boundaries, because the transaction looks like ordinary customer activity rather than delegated action.
What stops being true when an agent rides a customer session?
Two assumptions collapse at once: that the actor on the other end is a human customer, and that the session can safely stand in for a distinct delegated principal. Once the browser session is reused, the system loses a clean way to separate user intent, agent action, and session holder. That weakens trust boundaries even if the login itself remains valid.
It also means the session becomes a shared security object rather than a simple customer artifact. The browser state now carries both customer authority and agent behaviour, so controls that rely on principal separation, scoped delegation, or explicit consent become harder to enforce consistently.
Why the accountability model becomes ambiguous
When the same browser session covers both the customer and the agent, the event trail tends to look like ordinary customer activity. That makes attribution harder for incident review, customer support, fraud triage, and policy enforcement because the system has no obvious signal that a delegated actor was involved. The practical problem is not only logging, but whether logs encode the right principal.
That is why a separate agent identity is so valuable: it lets you distinguish who initiated the action, who carried it out, and what authority was actually in force. NHIMG’s AI Agent Authorisation Guide is directly relevant here because it treats per-action policy, least privilege, and human approval as first-class controls instead of assuming the customer session should do all the work.
When that separation does not exist, revocation also becomes blunt. You may be able to end the browser session, but you cannot easily revoke only the agent’s delegated authority without also cutting off the customer, which creates operational friction and encourages teams to leave access in place longer than they should.
What control patterns become difficult to enforce
Customer sessions are designed for customer use, not for an autonomous actor operating with delegated power. That means session-based agenting often blurs site scope, action scope, and time scope. In practice, the brand may be forced to accept broader browser privileges than it would normally grant to an agent, especially when the agent can navigate, submit forms, and approve flows inside the same authenticated context.
Browser-driven agents are especially sensitive to this pattern because the session can be used as a shortcut around explicit authorization. NHIMG’s Browser and Computer-Use Agent Security Guide addresses this exact problem space, where browser sessions, profile isolation, and site scope need to be treated as security boundaries rather than convenience features.
The same issue shows up in broader agent governance: if the browser session is the only identity signal, then the organization cannot reliably impose step-up checks, separate approval gates, or narrower tool rights for high-impact actions. A session can prove that someone was signed in, but it cannot prove that the agent had the right to act on every request it makes.
How delegated access should be separated in practice
The clean design is to keep the customer as the customer and the agent as a distinct delegated principal, even if the agent is acting on behalf of the customer. That allows policy to distinguish between login, delegation, and execution. It also makes it possible to record agent-specific logs, enforce narrow scopes, and revoke the delegation without invalidating the customer’s entire browsing state.
For identity design choices, NHIMG’s Agentic AI Identity Guide is the stronger reference because it frames the core problem as identity registration, delegation, authentication, and retirement for agents, not just generic session handling. That is the right model when the question is whether the system can still distinguish one actor from another.
Where teams are still using shared browser state, the immediate question is whether they can enforce an auditable handoff, per-action authorization, and a kill switch that targets the agent rather than the customer. NHIMG’s AI Agent Observability, Audit and Incident Response Guide is useful because it focuses on attribution, signals that the agent has gone wrong, and revocation paths that preserve response quality.
Risk and Threat Considerations
Reusing a customer browser session makes it easier for an agent to exceed the authority the business intended to give it, because the system cannot tell whether a given action was a human step or an agent step. That creates both governance risk and abuse risk: the same session can be used to hide unauthorized automation, overreach into sensitive flows, or make later repudiation much harder.
Failure mechanism: The browser session becomes a mixed principal boundary, so authorization, logging, and revocation all key off the customer’s session instead of the agent’s real authority. That allows delegated actions to blend into ordinary customer traffic and can defeat attempts to constrain the agent by role, scope, or time.
Impact: Organisations lose the ability to apply agent-specific controls cleanly, investigate suspicious behaviour with confidence, or revoke the agent without disrupting the customer. In a dispute or incident, the lack of a distinct identity weakens accountability and can turn an otherwise containable automation issue into a broader trust problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST SP 800-63 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Agent-in-customer-session blurs who is actually authenticated. |
| NHI-05 — Overprivileged NHI | A customer session can give the agent broader authority than intended. | |
| NHI-10 — Human Use of NHI | The customer session is being used as the agent's operating identity. | |
| Recommendation — Separate agent authentication from the customer session and avoid shared authority. Scope agent access narrowly and remove surplus permissions for delegated actions. Prevent humans and agents from sharing the same identity-bearing session. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The problem is indistinguishable agent authority inside a user session. |
| Recommendation — Bind each action to a distinct agent principal and enforce per-action authorization. | ||
| NIST SP 800-63 | IAL — Identity Proofing | Distinct delegated identity requires a trustworthy onboarding and binding model. |
| Recommendation — Use a verified identity lifecycle before granting delegated agent authority. | ||
Practitioner Guidance
What to verify: Before allowing browser-session delegation, verify whether the agent has its own principal, its own audit trail, and a revocation path that does not depend on ending the customer’s session. If the answer is no, treat the design as shared authority, not delegated authority.
Decision rule: If the agent can do anything beyond trivial read-only assistance, do not let the customer session be the sole identity artifact. Give the agent separate authentication, scope, and logging so you can apply different limits when the task changes from browsing to acting.
Practitioner takeaway: The core failure is not session reuse itself, but loss of separable authority. If you cannot distinguish the agent from the customer, you cannot reliably govern, audit, or revoke the agent as an independent actor.
Related resources from NHI Mgmt Group
- What breaks when an AI agent is allowed to use a logged-in browser session instead of a governed connector?
- What is the difference between human identity governance and AI agent governance?
- Why is identity such a critical factor in securing AI agent systems?
- What breaks when an AI agent can read and write identity infrastructure in one session?