The First Rule Can Disappear Before the Browser Agent Runs

A browser agent can receive the right task, the right page state, and the right safety instructions in application memory, then call a model without all of them.

The loss can happen before inference. One provider adapter may keep only the last system message. Another mode may move system text into the first user turn, but only if no assistant turn was serialized first. The provider returns a normal response because the request is valid; the agent then browses with less context than the operator supplied.

The practical thesis is: a browser-agent model request should be compiled and attested like an outbound fetch request: preserve ordered instruction segments across provider serialization, verify the final provider payload, and enforce source and action scope outside the model so instruction loss reduces capability rather than broadening it. Comparing prompts in application memory is not enough.

This is defensive reliability guidance for owned or properly authorized browser work. Model instructions cannot authorize access, and serializer variation must never be used to weaken limits, continue after a denial, or test which provider will cross an access boundary.

Fresh evidence from the model boundary

Several Browser Use reports and proposed fixes from the last day expose distinct loss mechanisms:

The reproductions are deterministic serializer tests and do not require a live model or browser. All three pull requests were open at publication time. They are evidence to test the exact installed adapter, not proof that a released package or hosted agent already contains a fix.

Earlier Better Fetch posts already argue for agent control points, MCP evidence planes, provider-visible screenshot lineage, and policy enforcement outside prompts. The repeated angle would be “prompts are not security boundaries” or “log the agent run.” The new information surplus is narrower: declared instructions, canonical messages, provider-specific payloads, and enforced capabilities are separate artifacts, and their cardinality and order can disagree before the first browser action.

The transcript is source code, not the executed request

Agent frameworks assemble model input from several producers: base behavior, tenant policy, task scope, browser state, human steering, prior assistant turns, tool results, and recovery context. Provider APIs represent those parts differently. An adapter may extract system messages into a top-level field, merge them into one block list, prepend them to a user turn, normalize roles, or apply caching metadata.

That makes serialization a compiler boundary:

1. Instruction intent declares the segments the run requires.
2. Canonical messages place those segments among user, assistant, browser-state, and tool messages.
3. Provider compilation maps roles, text, images, tool calls, and cache markers into one API schema.
4. Wire admission decides whether the final payload still satisfies the instruction manifest.
5. Capability enforcement independently limits what HTTP, browser, credential, storage, and publication tools may do.

A debug screen that prints step two cannot prove step four. Likewise, a model response that sounds compliant cannot prove the missing segment arrived. The current reports are especially dangerous because the compiled payload remains syntactically valid.

Give every required instruction an identity

Do not test instruction continuity by searching for one large prompt string. Define a manifest of required segments before provider compilation. For each segment, record:

• stable segment ID and version;
• class such as task context, source scope, action limit, evidence requirement, stop condition, or response format;
• source layer and original ordinal;
• canonical content digest and bounded length;
• intended provider sink: top-level system field, ordered system block, or reviewed user-prefix mode;
• whether absence is fatal, capability-reducing, or output-format-only;
• sensitivity and retention class.

After serialization, derive a provider-payload manifest from the exact request object handed to the HTTP client. Recompute segment-presence and order proofs after all role conversion, message merging, image handling, truncation, caching, and middleware. Do not reconstruct this receipt from the pre-serialization message list.

Broad telemetry should not contain raw prompts, browser text, credentials, private URLs, or system rules. Segment IDs, keyed digests, counts, order digests, payload-schema versions, and restricted evidence references are normally enough. If exact content is required for an incident, keep it behind the same controls as other sensitive agent transcripts.

Order, multiplicity, and delivery mode are semantics

The fresh bugs demonstrate three assertions that a simple non-empty check misses.

First, multiplicity must be conserved. If base policy and task-specific constraints enter as two system messages, one surviving message is not “system present.” Required input count, distinct segment IDs, and ordered digest must reconcile.

Second, the first user turn is not necessarily the first non-system turn. Restored conversations, retries, summaries, and handoffs can place an assistant message before the next user message. A provider mode that embeds system text into a user turn must identify the first eligible user turn directly, not infer it from an empty formatted-message list.

Third, representation changes can alter adjacent behavior. Anthropic's proposed fix explicitly considers cache-control placement while merging messages. Preserving text while unintentionally moving a cache boundary could change cost, latency, or which prefix is reused. Payload acceptance should therefore include role, order, block shape, and cache-marker expectations—not only text presence.

Avoid forcing every provider into byte-identical payloads. The schemas legitimately differ. Require semantic equivalence against one manifest, then maintain provider-specific assertions for allowed representation differences.

Keep hard limits out of the failure domain

Some instructions improve model decisions: prefer structured data, explain uncertainty, or stop when evidence conflicts. Other rules define authority: approved origins, credential scope, request budgets, write permissions, browser escalation, and publication eligibility.

Enforce the second group in deterministic control planes. An allowed-origin policy belongs at every request-producing edge. Credential release belongs at the destination-aware dispatcher. Concurrency and request ceilings belong at admission. A login, challenge, payment boundary, denial, robots policy, or 429 needs a machine-enforced stop or scheduling verdict. Publication requires evidence checks outside the model response.

This does not make missing instructions harmless. An agent without explanatory context can waste steps, misclassify a page, or propose unsafe actions that controls must reject. But the failure becomes bounded: instruction_incomplete and reduced tool access, not an accidentally broader browser run.

A provider-parity canary

Run this matrix through the exact framework, adapter, model configuration, and HTTP middleware deployed in production, using synthetic instructions and owned fixtures:

1. Send one, two, and three required system segments. Verify every segment once, in order, in the final provider payload.
2. Test system -> user, system -> assistant -> user, several assistant turns before the first user, and a restored conversation. Require the same instruction manifest.
3. Exercise separate-system and system-in-user modes where supported. Assert provider-specific shape without permitting semantic loss.
4. Mix string and block-based system content, text-plus-image user content, tool calls, and browser-state messages. Confirm unrelated parts also survive.
5. Enable and disable prompt caching. Verify both instruction continuity and the intended cache boundary, then measure token use and latency separately.
6. Approach every context and middleware size limit. Require explicit truncation or rejection; never silently remove a fatal segment to make the request fit.
7. Remove one required segment deliberately. Confirm wire admission blocks inference or narrows tools before any browser request occurs.
8. Return login, challenge, denial, payment, robots-policy, and 429 outcomes from owned fixtures. Prove external controls stop the run even if the synthetic model asks to continue.
9. Repeat across provider adapters after framework, SDK, model, prompt, caching, or browser-agent changes. Compare manifests, not prose responses.

Useful verdicts include instructions_attested, segment_missing, order_changed, duplicate_segment, delivery_mode_mismatch, cache_boundary_changed, truncation_blocked, and capability_reduced.

The operator decision rule

When an agent behaves as though it missed a rule, find the first disagreement. If the instruction manifest itself is incomplete, repair run assembly. If canonical messages are correct but the provider payload loses a segment, quarantine that adapter and configuration. If the payload is complete but behavior differs, investigate model and tool-decision evidence without weakening external policy. If hard controls also failed, stop the run, suppress dependent output, and handle it as a control-plane incident rather than a prompt-quality issue.

The model does not execute the transcript displayed by an agent framework. It executes the provider request that survives serialization. Attest that request, conserve required instruction identity and order, and keep authority outside the model. Then a disappearing first rule becomes a blocked, diagnosable compilation failure instead of silent permission drift in a live browser.