Automation Policies
Every action. Checked in real time.
Automation Policies watch every click, keystroke, and navigation — blocking dangerous actions and pausing for human approval before they happen.
| Name | Company | ||
|---|---|---|---|
| Sarah Chen | Acme Corp | [email protected] | |
| James Okafor | Initech | [email protected] | |
| Maria Gonzalez | Globex | [email protected] | |
| David Park | Hooli | [email protected] |
Rule: Action Rules → Click → Keyword “delete”
Policy: CRM Safety (pol_crm_01)
Why Policies
Agents are powerful. That’s the problem.
An agent with CRM access can export every record. An agent on your banking portal can initiate transfers. Most platforms handle this with prompt instructions the agent can ignore. WebRun enforces it at the infrastructure layer — before the action reaches the browser.
Without Policies
Direct access. No interception. No audit trail.
With Policies
Every action checked, blocked, or paused for approval.
How It Works
Every action. Checked before it runs.
Most restrictive outcome wins.
Domain Control
Control where your agent can go.
Domain Rules determine which websites your agent is allowed to visit. Set the mode, add your patterns, and every navigation attempt is checked before the browser moves.
Allow All
The agent can visit any domain unless you explicitly block specific ones. Use this when your agent needs broad access but certain sites are off-limits.
Allowlist
The agent can only visit domains you explicitly list. Everything else is blocked. Use this for tightly scoped workflows — your CRM, your vendor portal, nothing else.
Blocklist
The agent can visit everything except the domains you list. Use this when the universe of valid sites is large but certain categories are always forbidden.
Capabilities
Limit what your agent can access.
Restrict entire categories of agent capability. Set each one to allow, block, or require approval — enforced before the agent acts.
Action Control
Control what your agent can do.
Action Rules govern the specific operations your agent performs. Each rule targets a category of behavior and can allow, block, or guardrail it based on keywords, regex patterns, or URL paths.
Agent Behavior
Tell your agent what to be.
The LLM Role is a natural-language instruction injected into every agent session. No code. No config files. Just tell it what to be.
vendor.portal.com/invoices
Rules define boundaries. The LLM Role defines intent.
Templates
Start secure in one click.
Pre-built policy templates give you a production-ready starting point for common compliance scenarios. Select a template, then customize the rules to fit your specific requirements.
Research Only
Read-only browsing. Blocks typing, file uploads, and shell commands. Guardrails form submissions. Regex matching for sensitive data patterns.
Financial Compliance
Guardrails on banking and payment domains. Blocks keywords like “transfer funds” and “wire transfer”. Regex matching for sensitive financial data.
Healthcare / HIPAA
Allowlist mode for approved medical portals only. Blocks SSN patterns and medical record numbers. Guardrails on patient pages. Blocks file uploads.
Strict Lockdown
Allowlist with explicit domains only. Guardrails on all typed text. Blocks shell commands and file uploads. Regex matching for all sensitive data patterns.
Compliance
Every decision. Logged and exportable.
Every enforcement decision is recorded in an immutable audit trail with full context. Export the full trail for compliance reporting, incident investigation, or regulatory review.
vendor.example.com
Domain Rules → Allowlist
Allowed
“Export CSV”
No matching rules
Allowed
“Delete Selected”
Action → Click keyword
Guardrail
*/admin/settings
Navigation → URL pattern
Blocked
Integration
One parameter. Any session.
Attaching a policy to a session takes one field: policyId. Add it when starting a session — via REST API, MCP, or the Playground.
curl -X POST https://connect.webrun.ai/start/start-session \ -H "Authorization: Bearer YOUR_API_KEY" \ -d '{ "environmentId": "env_abc123", "policyId": "pol_xyz789", "initialTask": { "taskDetails": "Extract invoices from vendor portal", "startingPoint": "https://vendor.example.com" } }'
A session can have a policy, an environment, both, or neither. Policies are reusable — create once, attach to any number of sessions.
Why WebRun
Governance that ships with the platform.
Most browser automation tools leave governance to you. WebRun builds it in.
| Capability | WebRun Automation Policies | Typical agent platforms |
|---|---|---|
| Domain restrictions | Allowlist, blocklist, wildcard patterns — enforced at the navigation layer | Prompt-level instructions (agent can ignore them) |
| Per-action control | Block or guardrail 12 action categories independently | Not available — actions are all-or-nothing |
| Sensitive data detection | Regex matching on SSN, CC#, API keys — at the enforcement layer | No built-in DLP |
| Human-in-the-loop | Guardrails pause the session with Approve / Reject / Take Over | Manual monitoring or no mechanism |
| Audit trail | Immutable log of every enforcement decision with full context | Agent logs only (no structured audit) |
| Compliance templates | HIPAA, Financial, Research-Only, Strict Lockdown | None |
| Policy enforcement model | Out-of-process — agent never sees the rules | In-process — agent enforces its own permissions |
| Infrastructure | Managed cloud — zero self-hosting burden | Self-hosted, self-secured, self-maintained |
| One-line integration | "policyId": "pol_xyz789" |
Weeks of custom governance tooling |
Give your agents rules. Keep your data safe.
Start with a compliance template. Customize from there. Attach to any session with one parameter.
Free trial · No credit card · 2-minute setup