Sessions and approvals
An agent never just takes your browser. It asks for a session: a short grant for some sites, for some time, with a command limit. You approve it in the extension side panel. Each layer below can only narrow what the one before allowed.
The session request
When an agent asks, Chrome shows a notification and the side panel shows a card: "Agent asks to use this browser". It lists:
| Line | What it means |
|---|---|
| Purpose | One sentence from the agent: what it will do and why |
| Sites | The only sites it may open, for example https://portal.example.com or https://*.example.com |
| Can | Open and read pages only, or Read pages and act on them |
| Asks you | Before anything that sends, submits, pays, deletes or uploads a file, or Before every click and keystroke |
| Until | When the session ends on its own |
Choose Approve or Deny. On approve, Chrome asks you once to let the extension reach those sites. If you refuse that prompt, the session is not approved.
A request waits while you decide. The agent keeps checking and does not start until you answer.
What each session allows
Read-only sessions can open pages of the approved sites, read them, take screenshots, and go back, forward or reload. They cannot click, type, scroll or hover.
Sessions that act can also click, type, press keys, choose options and hover. By default they do that without asking you each time. Only actions that send, submit, pay, delete or upload a file stop and wait for Allow: the side panel says "Agent wants to act" and the element is highlighted in the agent's tab.
The agent can ask for a stricter session that asks before every click and keystroke. You then approve each action.
The extension classifies each action itself, from the page. Neither the agent nor Orkestia's servers can turn the send check off.
Full control for this session
In a session that asks before every click and keystroke, the card offers Full control for this session. Tick it and the agent clicks, types and chooses on the approved sites without asking each time, until the session ends or for 60 minutes at most.
- Sends, submits, payments, deletions and uploads still ask.
- The tab group and the badge turn red while it is on, and the side panel says until when.
- Back to asking turns it off. Stop ends the session.
- After 60 minutes the session goes back to asking on its own.
Only you can turn full control on, by ticking the box in the side panel. An agent cannot request it.
Approve a list of sends once
For a batch of messages, an agent can show you the whole list first: each recipient and the exact text, up to 50 items. If you choose Approve list, each send that matches an item exactly (same person, same text) goes without asking again, once. Anything else still asks. A new list replaces the previous one, and the list ends with the session. The side panel shows how many items are left.
Logins, codes and CAPTCHAs
The agent never reads or types into password, one-time-code or card fields, and screenshots mask them. When a site needs a login, a code or a CAPTCHA, the agent asks you in the side panel ("Agent needs you"). Do it yourself in the agent's tab, then choose Done.
Watch and stop
- Agent tabs open in their own coloured tab group. The agent works only in its own tabs, never in the tabs you opened.
- Chrome shows its "debugging this browser" bar while an agent is attached. Cancelling it stops the session.
- The side panel lists Active sessions (commands used and the end time) and an Activity feed of every action.
- Stop ends one session at once. Stop all ends every session.
When a session ends
| Reason shown | What happened |
|---|---|
| closed by the agent | The agent finished |
| stopped in the browser | You pressed Stop or cancelled the debugging bar |
| denied in the browser | You chose Deny |
| expired | The session reached its end time |
| command limit reached | The agent used all its commands |
| browser unpaired | The browser was unpaired |
| relay restarted | The connection was reset; the agent opens a new session |
Limits
| Limit | Value |
|---|---|
| Session length | 30 minutes by default, 1 to 480 minutes |
| Commands per session | 500 by default, 1 to 10,000 |
| Sites per session | 1 to 50, https:// only |
| Full control | 60 minutes at most per session |
| Approved list | 50 items |
| Waiting for your approval of an action | About 2 minutes, then the agent is told nobody answered |
| Pairing code | Single use, 10 minutes |
Chrome's own pages (settings, the extension store) cannot be automated.
Send limits per site
Some sites restrict accounts that send too much. The extension keeps a ceiling on those sites that no approval, full control or list can lift. On LinkedIn: at most 2 sends a minute and 100 in any 24 hours, one message per person every 30 days, and never the same text twice. A send over a limit is refused before you are asked. The log behind it stays in your browser and holds a hash of the text, never the text.
What is recorded
| Data | Where it goes |
|---|---|
| Page structure, text and screenshots | To the agent of the session only. Orkestia does not store them |
| Passwords, cookies, sessions on other sites | Nowhere. They stay in your browser |
| Sessions: agent, purpose, sites, access, Ask or Full control, commands used, times | Your organization's audit, shown under Organization → Browsers |
| Commands: name, site, result and timing, and who let it run (you or full control) | Your organization's audit. Typed text is redacted, page content is never kept |
For a browser paired to an app workspace, the audit belongs to the organization that owns the app.
To read the history from the API or an assistant, start browser.session.list (sessions) or data.browser.command.list (commands; filter by node_uuid, session_uuid or since). You see the browsers you may see.
Connect your Chrome
Install the Orkestia extension, pair it with a one-time code from the console or your AI assistant, check it is online, and unpair it
Agent tools
The browser_* MCP tools an agent calls to use a paired Chrome, the order to call them, how approvals reach the agent, Staff actors, and the errors they return