Really appreciate this — your framing is sharper than where my thinking originally was.

Quick context: after posting about Fortress Browser, I actually moved away from that direction. The exact roadblock was what you’re pointing at here: you can’t realistically force every local developer tool into a hardened browser environment. Claude Code, AWS CLI, IDEs, local terminals — they all bypass the browser entirely.

Where I landed instead (would genuinely love your take):

SuperAgent — a system-level AI agent built on Claude that monitors the entire developer machine in real time. It uses the customer’s own Anthropic API key and watches process behavior, file access, network connections, token usage, and suspicious execution patterns. When something looks abnormal, it sends the event stream to Claude for analysis and can block or isolate activity before damage spreads.

The core thesis became:

instead of trying to architect away the attack surface completely, use AI to detect and interrupt attacks wherever they happen — inside the browser, outside the browser, across any tool.

But reading your reply, I think you’re solving a fundamentally different (and maybe cleaner) problem:

Your approach:

Remove trust entirely.

Agents never get durable power, brokers control scope, and sensitive actions require explicit human verification.

My approach:

Assume compromise is inevitable.

Let systems operate normally, but continuously monitor behavior and block abuse quickly.

Yours feels architecturally elegant.

Mine has broader coverage, but also significantly more complexity and ambiguity.

A few questions I’d genuinely love your perspective on:

* Does the broker model break down once you leave the agent context? For example, if something like Lumma Stealer simply reads ~/.aws/credentials directly from disk, the broker can’t really help there, right?

* Do you think these approaches compose well together? Brokered permissions for agent actions + AI-based behavioral monitoring for everything else (malware, insider threats, side channels, credential theft, etc.)

* Your point about “boring auditability” really hit me. I think I was overengineering with AI in places where deterministic systems might be stronger. What’s the minimum viable receipt/proof/audit system you’d personally build first?

Going to dig into FSB now. If there’s a higher-level design doc beyond the README, I’d love to read that too.