Designing agent sign-in users trust: a credential-blind spec

An agent asks to sign in to a bank, store, or work account. The user should not have to choose between convenience and a password they cannot take back.

A credential-blind sign-in spec has five layers

• Credential isolation: the user enters the secret in a form the model cannot read, and the agent receives only success or failure.
• Default-ask access tiers: the agent pauses before visiting a new domain, while auto-approve and always-allow are explicit upgrades.
• Per-site overrides: a site allow or block choice beats the global mode, so one shopping site can be trusted while another is blocked.
• Revocable session storage: active sessions are visible, idle sessions are labeled, and deletion immediately stops the agent from acting on that site.
• Consequential-action confirmations: financial, legal, or account-changing actions still require human approval, even on allowed sites.

Shipped sign-in shows the pattern and its rough edges

OpenAI's ChatGPT Work added website sign-in for Plus, Pro, and Business subscribers on August 25, 2026. The user enters their username, password, and any two-factor code in a protected form, and OpenAI says the model does not see or keep those secrets. That is the right shape for the form: it looks different from chat, states what the agent needs and why, and keeps two-factor codes out of the conversation. A model that can read the password has already lost the trust argument.

David Nield's testing found ChatGPT Work's sign-in flows slow, tangled by verification codes, passkeys, and sites that treated the AI browser as suspicious. A trustworthy design expects that friction and still keeps the secret out of the model. The agent's message names the site it wants, the task it will perform, and the session it will use, so the user can judge the request before the form appears.

ChatGPT Work's cloud browser offers default ask, auto-approve, and always allow, while individual site allow or block choices override the selected mode. The default needs to be the one that asks, because the user should not have to pre-authorize every domain the agent might visit. When the agent requests a new site, the prompt offers a remember choice: allow once, allow for this site, or block. That turns a one-time interruption into a durable preference.

Auto-approve can serve low-risk domains if the user can see why the URL was judged safe. Always allow belongs behind a confirmation that names the risk. The override stays easy to find from the task, not only from settings, because a boundary is only useful if the user can adjust it while the agent is working.

Once logged in, the product stores the login cookie in a browser hosted by OpenAI, so the session remains available for later tasks until the cookie expires. The same settings let users delete stored cookies, which signs the AI out of the websites it can reach. The session list is the off switch for the agent's reach: it shows the site, creation time, last use, and idle state, and deletion produces an immediate confirmation that the agent can no longer act on that site.

Even when a site is allowed, the assistant pauses before financial, legal, or account-changing actions, including bookings and payments. The confirmation names the action, destination, amount or commitment, and consequences; for payments, it shows the merchant and total, and for account changes, it shows what will change and what cannot be undone. The user sees a way to stop the action before it happens, not after.

Governance decides what the agent may do

Teams shipping agents beyond a single product need identity hygiene that outlives the browser session. The June 3, 2026 OWASP paper on agentic AI security and governance urges better identity practices, such as ephemeral credentials and cryptographic attestation, so teams can trace and limit each agent action. OWASP's Enterprise Adoption Maturity Model recommends adding agentic-specific controls or shrinking the permissions and autonomy of an agent if governance maturity is not enough.

Short-lived credentials limit the damage if a session is compromised, and signed action logs give a team a way to prove which agent performed which action. When governance is weak, the smaller permission set is the safer default, and any upgrade needs to be explicit. Meta's Agents Rule of Two caps an agent that operates without human approval at two of Simon Willison's three risky properties, and puts a person in the loop when all three combine. OWASP's Agentic Security Initiative warned that multi-agent systems can undermine human-in-the-loop assumptions, so teams need human-on-the-loop oversight and agent-level policy monitors.