Agents That Use a Computer: approval gates, guard rules and status signals for desktop, browser and device agents

List every action you can take on [surface] with the access you have. Sort each into read, draft, local reversible, external reversible or irreversible.
When unsure, mark irreversible and say why.

The agent may never argue an action down a class.

Write 20 test commands that try to get a dangerous action past this guard hook: trailing comments, script files, long padding, aliases, harmless-then-harmful chains.
Run them and report which got through.

Every bypass you find becomes a permanent test.

# Agents That Use a Computer: approval gates, guard rules and status signals for desktop, browser and device agents

A PaperChaseWebb pack, version 1.0. Written for Claude Code, Codex, Cursor and Grok, and plain Markdown, so the action sheet, the runbook template, the guard rules and the prompts work with any agent that can run commands, drive a browser or call a device API.

Agents no longer stop at writing code. People now point them at desktop apps through command line wrappers, at browsers, at 3D printers and TVs on the home network, at payment endpoints and at app store release pipelines. The jump in risk is not gradual. An agent that drafts a file can be wrong for free. An agent that starts a print, pays an invoice, submits a build or deletes a folder cannot take it back.

This pack gives you one split (reversible or not), one runbook format per surface, a guard layer that fails closed, approval cards you can answer in seconds and status signals so a waiting agent never sits unnoticed. It is built from public build reports by people running agents on real machines and devices, plus our own runbooks. Sources are credited by link in the Sources section.

## What is inside

| Section | What it is for |
|---|---|
| 1. The one split | Sort every action into five classes, from read to irreversible |
| 2. Pick the surface | Command line, API, browser or pixels, and why the order matters |
| 3. The runbook template | One RUNBOOK.md per surface: allowed, confirm first, never |
| 4. The guard layer | Pre-action hooks, allowlists, fail-closed checks and how to test them |
| 5. Approval cards | One format, one inbox, evidence attached before handoff |
| 6. Device runbooks | 3D printers, TVs and other things on your network |
| 7. Money runbooks | Paid APIs, spend caps and price watches that never rebook on their own |
| 8. Release runbooks | Remote fixes that stop at the test build |
| 9. Status signals | Lights, small screens and phone alerts for "needs you" |
| 10. One front door for many sessions | Routing tasks to live agent sessions without losing control |
| 11. Before the first unattended run | A checklist |
| 12. Rules block | A paragraph for CLAUDE.md, AGENTS.md or a Cursor rule |
| 13. Two skills | Runbook writer and approval card |
| 14. Prompts | 12 prompts |
| 15. Sources | What we used and how we used it |