The gate for an agent belongs in the environment, not in the agent

Alex Amancio (Candoa) — Fri, 31 Jul 2026 21:47:25 +0000

There's a discussion running on Product Hunt right now about where an AI agent should stop and hand a decision back to a person. The framing that stuck with me: "can this be undone?" is the wrong gate. It over-fires on things nobody cares about, like writing a log line, and under-fires on the ones that actually hurt. A mass email. A migration you can only roll back with downtime.

The proposed replacement is reach. Not "is this safe" but "how far does this go if I'm wrong." And the sharpest point in that thread is that the agent is the worst possible judge of its own reach, because it doesn't know there are 50,000 people on the list.

I've been building a browser with an agent in it, and the browser case makes that concrete in a way the terminal case doesn't.

A coding agent's blast radius is usually one person: you, reading a diff. A browser agent doesn't start there. It inherits every session you're already signed into. The reach of a click isn't a property of the agent's plan, it's a property of the cookie jar it's holding. The same "click the blue button" step is harmless on a docs site and irreversible on a payments dashboard, and nothing in the agent's own summary distinguishes them.

So I stopped trying to make the agent classify risk. Here's what I do instead, with the caveat that this is alpha and I've been wrong about it before.

Some things never reach the model. Credential fields are filtered out of the page snapshot before the agent sees it. That means password inputs, and anything with cc-number, cc-csc, cc-exp, or one-time-code autocomplete semantics. A fill targeting a password field refuses outright. The agent cannot misjudge the reach of a control it was never shown, and that's a stronger guarantee than any classifier, because it doesn't depend on getting a judgment right.

The model's judgment is a floor, never a ceiling. For everything that does reach it, the agent can say "this needs approval" and be believed. It cannot say "this is routine" and be believed. A structurally sensitive control still escalates to a native confirmation even when the model called the action ordinary. The agent can raise the gate; it can't lower it.

Sensitivity is read off the DOM, not off the plan. What marks a control sensitive is its type and autocomplete semantics, which is evidence in the page itself, rather than the agent's description of what it means to do.

A timeout is a denial, not a wait. A stalled job is a silent failure; a denied one is loud, and loud failures get fixed.

The part I haven't solved is denied-and-resumable. Discarding the work is clean and useless, because people want to come back twenty minutes later and continue. But that means storing the world as it was when the question was asked, and the world moved. In a browser that's especially unkind: the DOM you asked about doesn't exist anymore. I don't have a good answer for it yet.

I built a headless React chatbot widget for full UI control

Alex Amancio (Candoa) — Sat, 31 May 2025 18:15:23 +0000

🧱 I built a headless React chatbot widget so devs can fully control the UI
Most chatbot widgets come bloated with their own styling and markup. I wanted something I could completely control — so I built my own.

👉 @candoa/chatbot is a headless React chatbot widget built for devs who love:

full UI freedom,

TailwindCSS,

React Hooks,

and minimal dependencies.

⚡ Key Features
Headless architecture (bring your own UI)

Conversation persistence (localStorage)

Greeting messages

Typing indicators

Error handling

Demo GIF: https://candoa-public.s3.us-east-2.amazonaws.com/chatbot-ezgif.com-loop-count.gif

🛠️ Install

npm install @candoa/chatbot

or

yarn add @candoa/chatbot

📦 Example

import { useChatbot } from '@candoa/chatbot'

const { state, actions } = useChatbot('your-project-id')

return (
  <div>
    {state.messages.map((m) => (
      <div key={m.id}>{m.text}</div>
    ))}
    <button onClick={() => actions.sendMessage('Hello')}>Send</button>
  </div>
)

I’m a solo dev working on this. Would love your feedback or ideas!
GitHub: https://github.com/aamancio/candoa-chatbot

DEV Community: Alex Amancio (Candoa)

The gate for an agent belongs in the environment, not in the agent

I built a headless React chatbot widget for full UI control

or