Sign in or Join the community to continue
Agents Acting Safely on Our Behalf
Posted Oct 15, 2026 | Views 11
Share
Speakers
Sarah Drasner
Area Tech Lead, AI Web Ecosystem, Chrome @ Google
Sarah is a Distinguished Engineer and Area Tech Lead for AI and the Web Ecosystem for Chrome at Google. She was formerly Sr. Director of Engineering at Google, leading the Core Infrastructure teams that power Google apps (Search, YouTube, Workspace, Cloud, etc.) on the Web, Android, iOS, Multiplatform, Experimentation, and Client Observability. She was Incident Commander for Core Developer Infrastructure at Google and led the Search mission for Core Developer- working across thousands of engineers to ensure the success of Search with Core Developer Infrastructure.
Sarah Drasner is an award-winning Speaker, and she was formerly VP at Netlify and Principal at Microsoft Azure. Sarah is an instructor at Master.dev and has written two books. She co-organized Concatenate, a non-profit that created free conferences and workshops for Nigerian and Kenyan developers with Chris Nwamba. She likes cheese.
+ Read More
Demetrios Brinkmann
Chief Happiness Engineer @ MLOps Community
At the moment Demetrios is immersing himself in Machine Learning by interviewing experts from around the world in the weekly MLOps.community meetups. Demetrios is constantly learning and engaging in new activities to get uncomfortable and learn from his mistakes. He tries to bring creativity into every aspect of his life, whether that be analyzing the best paths forward, overcoming obstacles, or building lego houses with his daughter.
+ Read More
SUMMARY
What happens to the web when the ones browsing it are no longer people? Sarah Drasner, Area Tech Lead at Google, sits down with us ahead of her Agentic Web keynote at AGNTCon + MCPCon North America. She works through that question from both directions: rebuild the web so agents can use it properly, or build agents smart enough to handle the web as it already exists.
+ Read More
CONTENT & TRANSCRIPT
Demetrios: [00:00:00] I've been thinking a lot about do we need to change the web for agents or do we need to just make agents better so they can use the web for us?
Sarah Drasner: No, we should be changing the web for agents. But you could imagine if it worked out of the box for React and Vue, and all you had to do was do a package JSON flag change, that that might make it a little easier.
Sarah Drasner: I do think that site builders should eventually explore WebMCP.
Demetrios: It's like it works, but it's not what you want to have working. Can you tell me the story of WebMCP? Like, how did that even become a thing?
Sarah Drasner: It was a little wild. I'm not gonna lie.
Demetrios: What is the talk about at Agent Con North America, October 22nd and 23rd?
Sarah Drasner: Yeah, I'm really excited to talk about [00:01:00] how the web is changing due to AI. It's changing on a number of vectors. One is, first of all, just that agents are present, and so we've got this fourth actor on the web. How do we secure it? How do we expose good APIs so that it can navigate appropriately and well, so that people can guide their businesses?
Sarah Drasner: And then also just making sure that we're putting the user first in the whole, um, transaction.
Demetrios: Yeah. So many different rabbit holes we can go down on each one of these. I mean, the secure part is probably what I think most folks think about when they think about agents acting on our behalf. But there's also, like, just the web part and agents using the web, and so I've been thinking a lot about, do we need to change the web for agents, or do we need to just make agents better so they can use the web for us?
Sarah Drasner: No, we should be changing the web for agents. And by saying that, I don't mean that we need to rewrite everything. [00:02:00] Um, WebMCP offers really wonderful tooling, and it's a pretty elegant, simple API. Um, what we're working on now are ways, and what I'm working on now are ways that we can actually use what people have already written to expose WebMCP tooling.
Sarah Drasner: Hmm. What WebMCP tooling allows you to do is to specify what exact actions you want the agent to be doing, and you can also add annotations. So as you're adding the annotations, you can say that it's read-only, that it's user-generated content. That can allow the agent to know, "Oh, okay, I'm not gonna take action on anything in here."
Sarah Drasner: Like, if you have a bunch of comments on your site that are user-generated, you can't necessarily trust that people aren't injecting prompt injection attacks in there. So the agent actually has a signal, "Hey, don't, you know, go forward with anything that's put embedded in there into the web ephemera." Um, so that can help, um, the web stay secure and safe.
Sarah Drasner: There's also a consequential t- hint, [00:03:00] which allows you to say, "Hey agent, you're about to do something that's potentially consequential for the user. Please go back to the user and confirm." Otherwise, agents are just scraping the DOM, scraping the accessibility tree, taking screenshots. It's token inefficient.
Sarah Drasner: It's slower. The site developer is just kind of like, you know, at the whim of however non-deterministically these LLMs decide to take action on the site. And so this gives us a really deterministic surface area in order to guide the agents exactly what we want them to be doing and in a safer way.
Demetrios: You're speaking my language. I love this. There's so many pieces to that, that I'm a huge fan of. How do you look through and think about, like- computer use or browser use agents versus the API or MCP type agents
Sarah Drasner: Yeah, I mean, there's so many different ways that a browser can be used these days, [00:04:00] right? You have in-app browsers where people are, you know, if you're on a certain, like, super app, they might keep you within that instead of allowing you to go to whatever your browser of choice is.
Sarah Drasner: You might have computer use, uh, apps or com- computer use, um, ways of working, like 24/7 headless models where you kind of set it and forget it and let the agent do whatever. You also have co-browse, where you are a human in the loop and you're actually in the experience. We're seeing more and more that people might wanna switch between these modalities.
Sarah Drasner: Like, maybe there's one where you just wanna do it yourself. Maybe there's one where you're, you would like actually a little bit of co-browse because you want, like, "Hey, Google Maps, like, show me all of the restaurants in a particular area that I can afford," da da da da da, and you wanna actually s- be part of that experience instead of, um, letting an agent run wild.
Sarah Drasner: And then finally- Hmm ... there are tasks where maybe you're part of the task. Let's say you're, like, getting ready for a holiday. This is the only time every year that you get to [00:05:00] plan such a holiday. You wanna be intrinsically part of that. But then there's one part that's like, "Go through all the TripAdvisor things and tell me, like, which ones are most valid to this kind of query."
Sarah Drasner: Like, you don't have to sit there for, for something like that. But you might wanna be involved in something like the airline pur- purchase or something like that because you wanna pick your seats and stuff. So what we're seeing is, like, peop- more and more, it's not just one modality, and this is also the dream of the web.
Sarah Drasner: The dream of the web was not just one experience ever, or one person or one user or one type of commerce site, content site, whatever. It's supposed to be for everybody at every level. Some people have high appetite for agents, some people have low appetite for agents. We have to keep the web safe and secure for all of those different pathways.
Demetrios: It's funny, as you mention that, I literally have my other computer over here off screen, and it is downloading a bunch of, uh, logos of companies [00:06:00] because one of the things that I tasked my agent with doing is grabbing all of the photos from our recent, uh, MCPCon and AgentCon in China and Japan, and then taking the speaker photos and uploading them to Canva so I can go and I can make the thumbnails.
Demetrios: Mm-hmm. But then I realized, like, oh, I need the speaker photo, but I also need their, the logo of the companies that they work at. So it got the speaker photos and it downloaded them from Flickr, and then it uploaded them from-- It filtered out whoever, wherever there was photos that weren't speakers, and then it uploaded the right ones to Canva, and then it put their names and the title of their talk so I can easily search it.
Demetrios: And then, and then I'm like, "Oh, but I need the logos." So now it's literally just popping up with websites and grabbing logos and then uploading them to Canva too. And that's something where I look at it as exactly what you're saying Where I am letting it do all of that monotonous heavy lifting [00:07:00] of downloading, uploading, searching for logos.
Demetrios: But what I wanna do is that creative part of taking the photo, adding the logo, and then making it... Is it, should it be a little bigger here, I think? Uh, ah. And that's where I actually find the joy in it.
Sarah Drasner: Yeah. And that, I think that that's like, that is the most powerful part, is that it should be tailored to what y- the user wants.
Sarah Drasner: Mm. It should not be, "Oh, there's agents, so you're gonna use an agent." It should not be, "Oh, I have to be in the loop." It should be exactly the experience you feel comfortable with, that you feel secure with, and we should be also tightening the security and privacy of each one. So-
Demetrios: Mm-hmm ...
Sarah Drasner: what we have seen is that it's not gonna be one thing that secures the web.
Sarah Drasner: We have to use multi-layered defensive strategies, because agents can be non-deterministic and they can do all sorts of things. And so you have things like special agent containment, where you might say, like, "Okay, [00:08:00] me, Sarah, can look at all my passwords, and has my credit card info, and all of this stuff.
Sarah Drasner: But Agent Sarah, well, she can only go to these five sites, and she only has access to this information about me. And she can only buy, spend $20 this month, or maybe none, or whatever." And that way you can, like, kind of define what you, what experience you want your agent to have. Another one is, um, origin sets.
Sarah Drasner: So if you decide to go on, like, a trip or something, and you're like, "Okay, plan this trip for me," it should only be going to Expedia, and United, and those kind of sites. It should not be going to your bank and to your, like, health site. Um, another one is spotlighting. So, like, let's say you have a large context window full of a lot of things.
Sarah Drasner: The things that you decide as a user are most important should be, like, in-- We use the term spotlighting, like more important to the, in that- Mm-hmm ... context window, or have a greater weight than all of the [00:09:00] other pieces of information. So it, I'm just talking about a few. There's so many ways that we can protect the web, but we have to use them all to make sure that we're creating good and safe journeys.
Demetrios: I like how you got those agents on an allowance. Uh- Yes. They can only, you can only get $20 if you make sure to do all of your
Sarah Drasner: work. That's right. That's right. That's right.
Demetrios: And, uh, if not, you're not getting that allowance. I'll tell you what. So the other thing that I was gonna ask you about, which I always find fascinating, is, like, when you're- Uh, after you've reached a certain level of engineer, and this is more like just how you think, less about your talk- Yeah
Demetrios: just, um, prefacing it. I think there's... We always joke, like, uh, friends and I tend to joke about how you work with some engineers and they have, like, a really good nose or they can smell when there's a business [00:10:00] problem that's worth solving. And so I wonder how you think through that. Like how, if you're gonna spend your time on something, how do you make sure it's that really impactful thing versus something that may not have, carry as much weight?
Sarah Drasner: Yeah. I mean, as a distinguished engineer, that is one of the, like, parts of the job is being a strategic lead. Like- Yeah ... deciding a, you know... I'm what we call an area tech lead, meaning that I go over a large surface area of Google. And so I look over the AI and the web ecosystem for Chrome, um, which includes- Mm
Sarah Drasner: a lot of different things. WebMCP is one of them, on-device AI, all sorts of things. Um, so when I think about things, I do have to constantly... 'Cause I get deep as well. So if you get- Yeah ... deep, what happens is you naturally think about the problems in a very tactical, tactical way too. But I always- Yes ... have to bump myself up a [00:11:00] level to also see things from a higher purview.
Sarah Drasner: It helps that I can be across many, many different projects. Um, and I actually pull different groups together so that they're aware of each other's work and kinda highlight and have the, they do, them do information sharing across groups too, because people tend to silo real deep, and then
Demetrios: you- Mm-hmm ...
Sarah Drasner: you forget to bump up at that level.
Sarah Drasner: But I also encour- you know, I, I make myself write papers with that thousand-foot view that could look like a pre-mortem. Pre-mortems can look like, "Okay, the web failed in five years. What, what happened?" And that forces me to look back and say, "Okay, well, this couldn't happen, this can happen, this can happen," and then revisit, like, okay, how do we make that not occur, and trace backwards some steps.
Sarah Drasner: So that's one, like, way of thinking that helps. Another way of thinking is to have deep [00:12:00] empathy for the users and the site builders and think through from their perspective, what do I need if I'm an a- you know, if, if I'm smart and not technical, if I'm a doctor or a lawyer and I have to s- I have to... I'm under HIPAA or I have attorney-client privilege, what do I need in order to feel like I can even use an agent at all?
Sarah Drasner: Like, what kind of privacy and security would I need to be assured that my things aren't leaking and getting, um, used improperly or that I'm being su-suspect to a prompt injection attack or something like that? And from there, developing strategies of like, okay, well, I would probably need this, I would need this, and you can extract from that What can make it easier to do those things?
Sarah Drasner: Like I mentioned, um, finding these pathways to make WebMCP work more like out of the box with existing systems. That doesn't need to happen, but I think it [00:13:00] should happen because that also increases like the ability for developers to opt in without a lot of work, for businesses to be able to use it without having to like rewrite in a whole new mental model because they can reuse existing infrastructure they've already built.
Sarah Drasner: So anything that helps me kind of think through things and pose questions to myself at a higher level and walk backwards into the more tactical work, 'cause you can start to extract the tactical work from those larger questions, that's something that I force myself to do.
Demetrios: That's so cool. And yeah, the like thought experiments and thinking about how to come up with thought experiments, I imagine has gotta be, uh, a lot of the way that you spend your time just because there's...
Demetrios: I can only think about how many different folks that are pulling you and trying to get you- Yes ... like, "Hey, this is important right now." Yes, yes. "We need to, we need to think [00:14:00] about it." And then you're having to balance- Yes ... between all of those different, like, demands.
Sarah Drasner: That's right. That's right. And it does require a lot of reading, a lot of-- So you, you s- it also requires, I mean, honestly, time management, because I'm in so many, like, different things that I have to always set aside a big amount of b- focus block.
Sarah Drasner: And Google, uh, our love language and communication is Docs and Slides. Yes. Um, so I have to have time every week to process all of that material, to understand what people are trying to build and make, go through CLs, like, play with things myself, make sure that I understand in order to make some of those calls and decisions.
Sarah Drasner: Like, we were, you know, going through something the other day where I noticed that one of the decks in Docs was incongruent with how we were actually doing the implementation. [00:15:00] Uh-huh. And you have to dig in deep enough to trust but validate the things that people are mentioning to you across teams. It doesn't mean that you don't, it doesn't mean that you don't trust the people.
Sarah Drasner: It just means that, like, if we're strategically saying this, are we really standing behind that in technical implementation and, like- Mm ... making sure that it's the same.
Demetrios: Uh, can you tell me the story of WebMCP? Like, how did that even become a thing?
Sarah Drasner: Yeah. So just to be clear, I moved into this role in April, so I haven't been here from, like, the beginning of the entire spec.
Sarah Drasner: Um- Okay ... the, um, the spec started, as I understand it, at, um, Microsoft and Edge. Um, I do actually think Alex Na- Nahas, who does, um, WebMCP B, originally started thinking about the idea, and then Edge started working on, like, the spec proposal, and then Google got involved. [00:16:00] Um- Mm-hmm ... and now Google does a lot of the work.
Sarah Drasner: Um, but it's always been, like, a cross-team, cross-system collaboration, which is a good thing, not a bad thing. Yes. Um, so I joined in April. Before that, I was running core infrastructure for Google, so I ran web at Google, Android, iOS, multi-plat, experimentation, observability. I was also, also the reliability for all of core, which means that if anything went down across Google, I was on point to, for our internal stacks.
Demetrios: It was a little wild, not gonna lie. Yeah.
Sarah Drasner: I worked with Chrome before I had this job, but they were one of many, many people I worked with, right? So I, I worked with Workspace and YouTube and Search and, um, those were all my customers. And then I moved over in April to this role. So I'm no longer doing the large scale, um, technical organizational leadership of core infrastructure at Google.[00:17:00]
Sarah Drasner: Now I'm a distinguished engineer, so I switched, um, tracks but not levels. So now I'm on the ice, what we call the IC track.
Demetrios: Yeah. Nice. So a little bit of a random one on WebMCP that I've been really enjoying is Can I build a WebMCP proxy or gateway to many different websites that would, if I know how the, your website works?
Demetrios: Because I'm just worried that half the internet is never going to build anything WebMCP related because they either can't or they don't want to.
Sarah Drasner: No, you don't. You, you are the owner of your site's WebMC- WebMCP imple- implementation. You're not making it for other sites. That's not a, a thing that you can do.
Sarah Drasner: Just like when you build your site, you're building your site, you're not building other people's sites. It's the same kind of concept. It doesn't go outside of the, like, site development things. Um, but you could [00:18:00] imagine if it worked out of the box for React and Vue, and all you had to do was do a package.json flag change, that that might make it a little easier to adopt.
Sarah Drasner: We're also exploring things to make it work out of the box without, like, the site builder having to do, like, you could just use this other thing that would, like, analyze your DOM. The problem with the analyzing, like, that, that's a good s- it's a good stopgap if you don't have time to do an, a WebMCP implementation.
Sarah Drasner: Yeah. But the issue with it is it tracks based on DOM, and DOM isn't the state of your application. So, um, I think that approach can be helpful in a transitionary period, but I, I do think- Not ideal ... that site builders should eventually explore WebMCP, yeah.
Demetrios: Yeah. Yeah, so it's, it's, like, it works, but it's not what you want to have working.
Sarah Drasner: Yeah, and it's [00:19:00] also, like, I think, like, some people get confused because they think that if you have WebMCP, you're trampling on MCP or you're trampling on REST or GraphQL. This is not the case. Anything that is- Mm ... exposed within your UX or UI that is a state that you'd already be exposing with React or what have you, can just be the execute piece of WebMCP, and that includes allowing you to use MCP and GraphQL and REST and things like that.
Sarah Drasner: So I, I think that they come together. If, if you w- actually work with it, they actually play really nicely together. It's not like a either/or.
Demetrios: Yeah. At Agent Con, I heard someone talking about how, at Agent Con EU, I mean, um, someone was mentioning how they built a WebMCP, and the only thing it did was it linked to the MCP server But [00:20:00] it was, it's like, ah, it's not ideal.
Demetrios: Again, it's, but it's something that will get you what you need to get to, uh, uh, in a little bit of a hacky way.
Sarah Drasner: Yeah, I mean, you don't have to expose it that way either. I mean, you can. What I would think about it more like, okay, if you... Let's just do a cart checkout flow for a second.
Demetrios: Yeah.
Sarah Drasner: On the client, you probably normally expose to the user your cart total, like things like, um, whether or not you're, you know, navigating to the page, the like full thing, and then you do the cart checkout and then you have on the client like success, error, submission, things like that.
Sarah Drasner: And especially if you're in a co-browse environment- Yeah ... you want the page to actually be activated to show all of these things.
Demetrios: Yeah.
Sarah Drasner: Um, and so you would use both. And you could actually just do WebMCP, WebMCP, MCP, WebMCP, Web... So like there's, you know, you don't h- you can also do [00:21:00] just chained WebMCP and then one of them calls MCP.
Sarah Drasner: You can do it either way. Um- Mm-hmm ... but I, I do think that there's also things like auth and things like that that you- Yeah ... want to be exposed via the client to the per- to the user. So a lot of it has to do with, like, how your implementation is already working in your UX. The other thing I'll say is I've had a lot of fun thinking outside of, you know, the first step is exposing what you already have on the site.
Sarah Drasner: Like what- Yeah ... whatever you're already doing on the site. But the next step is I've been making tools that allow you to do batch processing. So I have a to-do list. I can just say, and this is good for accessibility too, I can now say to Gemini or whatever, like, "Hey, close out my day," and it will, uh, automatically take all the to-do items and carry them over for tomorrow and also start my journal entry.
Sarah Drasner: Or it will- Nice ... allow me to, in a shopping cart [00:22:00] thing that I've made in open source, it allows me to dump usuals into my ch- cart. Like anything that I've ordered more than 10 times, it automatically puts them all into my cart. Like, those are things that first of all, manually you'd have to do differently.
Sarah Drasner: Um, they're also things that you're kind of like exposing on the client to the user, and you probably want them to be able to see that that's all working appropriately and what's in the cart and things like that. And so there's opportunities to go beyond just the, like, exposure of the simple actions into something that is potentially really good for people with accessibility issues, but also just people who are busy.
Sarah Drasner: I don't, I don't us- Yeah ... I don't wanna go through and like... And it's doing that mental math for me of like, "Wait, I always get eggs." Um, so that's good.
Demetrios: It's an opportunity to delight the customer in ways that they weren't expecting.
Sarah Drasner: That's right. That's right.
Demetrios: Brilliant. Sarah, this has been awesome. Thank [00:23:00] you for doing it.
Sarah Drasner: Yep.
+ Read More
Watch More
Software Engineering in the Age of Coding Agents: Testing, Evals, and Shipping Safely at Scale
Posted Feb 10, 2026 | Views 642
# AI Agents
# AI Engineer
# AI agents in production
# AI Agents use case
# System Design
Generative AI Agents in Production: Best Practices and Lessons Learned // Patrick Marlow // Agents in Production
Posted Nov 15, 2024 | Views 6.5K
# Generative AI Agents
# Vertex Applied AI
# Agents in Production
Building Reliable Agents // Eno Reyes // Agents in Production
Posted Nov 20, 2024 | Views 1.8K
# Agentic
# AI Systems
# Factory