The active browser profile is not neutral infrastructure
So agent tasks run in their own Task Space: own profile, own cookies, own allowed sites, own lifecycle. Cancel the task and the exact process it owns dies. Your browser never notices. And you can always answer the basic questions: which task opened this, what can it reach, what stops when I cancel?
Under the hoodHow it works
- A Task Space owns its browser context, profile identity, lifecycle, and allowed scope.
- Cancellation targets the exact managed process rather than any browser with a similar name.
Scope identity, origins, and persistence together
Task ID alone isn't a boundary if the profile can be silently reused. Task identity, profile identity, generation, allowed origins, and persistence mode travel together. Ephemeral for throwaway research, persistent for deliberate continuity. Neither mode means "reaches everywhere."
- Task identity prevents cross-task reuse
- Generation rejects stale resumptions
- Allowed sites limit navigation
- Profile mode decides whether sessions persist
Under the hoodHow it works
- Bind task ID, profile ID, generation, allowed origins, and persistence mode into the same authorization decision.
- Reject stale generations and silent profile reuse before navigation or resume.
Make human takeover a first-class state
Sign-ins, CAPTCHAs, purchase reviews: those are yours. The handoff is a real state transition, not an informal pause. When you return control, the agent resumes only if the same Task Space is still valid. It never touches your normal browser.
Under the hoodHow it works
- Take Control and Return Control are explicit state transitions with the Task Space identity preserved.
- The agent must revalidate the current generation and ownership before resuming automation.
Recover only what Axiom can prove it owns
Browsers crash and updates swap binaries. Recovery checks signed metadata, digests, and process ownership as separate facts before resuming, recreating, or stopping. Guessing ownership from a process name is how an agent ends up killing your browser.
Under the hoodHow it works
- Verify signed runtime metadata, profile ownership, executable identity, and process ownership as separate facts.
- Recovery can resume, recreate, or stop the task; it cannot infer ownership from a process name alone.
Isolation improves boundaries, not website permission
Isolation defines where the agent runs, not what websites must accept. Authentication, anti-bot controls, and consequential-action confirmations all stay exactly where they were.
Under the hoodHow it works
- Isolation defines execution context and data separation, not additional website authority.
- Authentication, anti-automation controls, and consequential-action confirmation remain independent boundaries.
Sources and scope
We wrote this from Axiom's current code, regression tests, and recorded product checks. If a behavior has only passed a source test, we do not describe it as proven on every Mac. There are no invented benchmark numbers here.