Every agent platform demo looks the same: ask for something, watch a cursor move. The difference between a demo and something you would hand real credentials to is what happens between the decision and the action.
OpenBot, CopilotKit's new MIT-licensed platform, is built entirely around that gap. Each Bot gets its own container, its own /workspace volume and its own Chromium profile with its own logins; a supervisor creates and manages those machines, with an option to run them under gVisor. Every tool call — browser, file, MCP server — goes through one gateway that resolves the target from a server-held snapshot, evaluates a policy, writes an audit row, and only then calls the computer. The project's own phrasing is the design: there is no path that acts without the record existing first.
The policy language is CEL, and it fails closed. Rules can inspect the tool name, the intent, the bot and actor IDs, page URL and host, element properties, keys, files and MCP calls. Deny is evaluated before allow, a missing policy permits nothing, and a broken rule refuses rather than opening.
The human-in-the-loop design is unusually well specified for an alpha. When a Bot hits a login wall or a 2FA prompt it asks for help; control is handed over in the same panel and recorded as three distinct events. While a person is driving, the Bot's actions are refused rather than queued — the difference between a pause and a race condition. Secrets get their own discipline: the audit trail records that a secret was requested and how long it was, never what it said, and credentials are stored write-only and encrypted at rest.
Agents are portable. A Bot is any endpoint speaking AG-UI, the agent-to-user protocol, so LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK and hand-written agents all arrive the same way, and the governance rides the protocol rather than the framework. The MCP catalogue is curated, and any tool not positively classified as a read is treated as a write.
The caveats are the ones that come with an alpha. The default configuration runs with authentication disabled and admits every request as a single administrator, which is fine on a laptop and wrong anywhere else. It requires a CopilotKit Intelligence project and license, so the open-source core is not the whole system. The browser containers bind to loopback and hold real logins, which the documentation is explicit about leaving alone.
What makes it worth noticing is not the feature list but the convergence. Isolation per agent, a single policy chokepoint, and a record written before the action are showing up as the standard three primitives of agent infrastructure — in browsers, in sandboxes, in enterprise agent gateways. The interesting shift is in what gets designed first. The unit is no longer the agent's capability; it is the agent's permission. Capability is a prompt. Permission is a schema, a policy and an audit table.
For anyone building with agents this year, OpenBot is less a product to adopt than a reference design to argue with. Which actions should never be allowed at all, which should require a human, and which can run unattended — that is now the interesting engineering, and it happens before the first line of agent code.
