Autonomous Browser Agent + Harness
An autonomous browser agent with a real harness: durable, resumable state and a human approval gate before it's ever allowed to act.
Business Context
The situation
An R&D build into the part of agent engineering that separates a demo from something you'd trust near real systems: the harness. An LLM that can drive a browser is easy; an agent that can pause mid-task, wait for a human to approve a risky action, resume exactly where it left off, and survive a restart is a system. This explores that harness directly.
The hidden cost
- An autonomous browser agent can take irreversible actions — a bare LLM-with-tools has no gate
- Long browser tasks lose everything on a crash without durable state
- "Approve before acting" is meaningless if the agent can't actually pause and resume
The Problem
What actually had to be solved
Build the harness around a browser agent: durable state so a long task can survive a restart, a human-in-the-loop approval step so risky actions wait for a decision, and multi-surface control (Telegram/Slack) so a human can approve from where they already are.
Why the existing approach failed
A stateless agent loop can't pause for approval and resume — it either runs to completion or starts over. Without checkpointing, a crash loses the whole task. The interesting engineering is precisely the state and approval machinery that most demos skip.
Constraints
- Risky browser actions must not execute without human approval
- A long task must resume after a restart, not restart from zero
- Approvals should reach a human where they already work (chat), not a bespoke UI
- Real websites resist automation — control has to be robust
Before → After
How the workflow changed
Before
- Prompt the agent
- Agent acts immediately
no approval gate
- Browser actions execute
irreversible
- Crash = start over
no durable state
After
- Task issued (Telegram/Slack)
- Agent plans (LangGraph)
- State checkpointed
durable in MongoDB
- Risky action? Pause
- Human approves / rejects
resumeDecision
- Resume from checkpoint
- Stealth browser executes
Architecture
How the system is built
Wrap a LangGraph agent in a durable harness. Agent state is checkpointed to MongoDB so a run can pause and resume across restarts. A human-in-the-loop step intercepts risky actions and holds the run until a human approves or rejects (a resumeDecision), delivered through Telegram and Slack so approval happens in chat. Browser control uses Playwright with stealth; retrieval uses Pinecone; the LLM layer can route across providers.
Architecture — click any node
Client
API
Orchestration
AI
Integration
Data
Client
Chat Surfaces
Telegram · Slack
- Purpose
- Where humans issue tasks and approve actions.
- Responsibility
- Task input and approval decisions in chat.
- Failure mode
- Multiple surfaces — one being down doesn't block the other.
AI vs. Engineering
Where AI helps — and where it doesn't
AI Layer
LangGraph plans the task and the LLM router reasons over each step, grounded by Pinecone retrieval and acting through MCP tools. AI owns the open-ended parts — deciding what to do next on a page it hasn't seen before.
Engineering Layer
The harness is deterministic software and it's the whole point: MongoDB checkpointing for resumable state, the approval gate that holds risky actions until a human decides, a scheduler for background work, and stealth browser control. This is what makes an autonomous agent safe to point at real systems.
Engineering Decisions
The hard calls, with their tradeoffs
Decision 01
MongoDB checkpointing for durable, resumable state
Choice — Persist agent state to MongoDB so a run can pause and resume across restarts.
Why — Human approval implies waiting, sometimes for a while — the run has to survive a restart and continue exactly where it paused, not start over.
Tradeoff — Checkpoint storage and state-management complexity, in exchange for agents that are pausable, resumable, and crash-tolerant.
Decision 02
Human-in-the-loop approval before risky actions
Choice — Intercept risky browser actions and hold the run until a human approves or rejects.
Why — An autonomous agent acting on real sites can do irreversible things. A gate on the risky subset keeps a human in control where it matters without babysitting every step.
Tradeoff — Added latency and a person in the loop on risky actions, in exchange for safety and accountability.
Decision 03
Model routing across providers
Choice — Route the LLM layer across Google GenAI, Cerebras, and Cohere.
Why — Different steps have different cost/latency/quality needs, and provider diversity is resilience against a single outage.
Tradeoff — More integration surface, in exchange for cost control and fault tolerance.
Cost & Reliability
Built to run, not just to work
Cost strategy
Model routing sends each step to an appropriately-sized provider instead of defaulting everything to the largest model; scheduled/background execution avoids holding expensive resources open while waiting on approvals.
Reliability
Checkpointing makes every run resumable — a crash mid-task continues from the last checkpoint. The approval gate fails safe: with no approval, a risky action simply never runs. Browser control retries transient page failures, and provider routing tolerates a single LLM outage.
Security
Google OAuth (passport) for identity; the approval gate is the core safety control, ensuring a human authorises anything with real-world consequences.
By the Numbers
What we can point to
Durable + resumable
VerifiedState model
MongoDB checkpointing of agent state.
Human approval gate
VerifiedSafety control
resumeDecision holds risky actions.
Telegram + Slack
VerifiedApproval surfaces
Approve from where you already work.
Multi-provider routing
VerifiedLLM layer
Google GenAI · Cerebras · Cohere.
Business Impact
System → workflow → outcome
System
A browser agent wrapped in a durable, human-gated harness.
Workflow
Task → plan → checkpoint → pause on risk → human approves → resume → execute.
Operational change
Autonomous work proceeds unattended, but a human stays in control of the actions that matter — and nothing is lost to a crash.
Business impact
Demonstrates the harness that makes autonomous agents trustworthy near real systems: the difference between an impressive demo and something you'd actually deploy.
Reflection
Lessons & what we'd do next
Lessons
- Durable state isn't a nice-to-have for approval workflows — it's the prerequisite.
- Putting approvals in Slack/Telegram beat building a bespoke approval UI for adoption.
Risks
- Stealth browser automation must respect target sites' terms and legal boundaries.
- Approval-gate design is a product decision — too many prompts and humans rubber-stamp; too few and safety erodes.
Improve next
- Add a confidence/policy score to decide automatically which actions require approval.
- Instrument approval latency and rejection reasons to tune the gate.
Technology
The verified stack
Backend
Agent
AI
Browser
Surfaces
Auth + Data
Could this be relevant to your business?
If you're building agents that take real actions — and need durable state, approval gates, and safe execution rather than a hopeful autonomous loop — this is exactly the kind of harness we build.
Related Work
More systems we've built
AI Agent Operations Platform
An AI sales/support agent built like infrastructure — services over gRPC and a message queue — to explore what agent operations look like when they're engineered, not scripted.
Voice AI Companion
A production-shaped voice pipeline — speech in, reasoned reply out — with memory, safety, and observability as first-class services, not afterthoughts.