What an agent can and can't reach

Sval has no AI of its own, and Firefox’s AI features are turned off. An AI app you already use can browse in Sval for you, and Sval decides what it reaches. The app never decides that for itself.

One approval for the app

You approve an app once, and every session of it can use Sval after that. Sval treats each app as one agent, so the rules you set for its sites apply to all its sessions. You allow an app or you don’t. Approving it again for each folder it runs in would only make a new session look broken.

Approval stays until you unpair the app. Deleting one of its Workspaces doesn’t change it.

A Workspace for each session

Each session is its own piece of work, so each gets its own Workspace, in a window of its own. The agent sees and acts only in the tabs of that Workspace. Your other Workspaces and tabs are out of its reach, and two sessions never act in the same tabs.

The window opens behind yours and never takes your focus. While the agent works there, your clicks and key presses stay out, so you can’t type into a page by mistake while the agent is using it. Your media keys, a game controller, and picture-in-picture stay yours too.

You can take control of the Workspace at any time, or stop the agent. Both apply to that one Workspace. The app’s other sessions go on.

Your sign-ins, or none

Which sign-ins an agent can use depends on its Workspace.

A shared Workspace uses the same sign-ins as your own shared Workspaces. The agent can work in your accounts for you. It never sees your passwords, because Sval removes password values from what it reads.
An isolated Workspace starts signed out of every site. The agent can’t reach your accounts. It signs in itself where a task needs it.

The app asks for one kind when it pairs, and you can pick the other in the pairing alert. See What an isolated Workspace keeps apart.

Rules for sites

What an agent can do on a site follows a rule for that site, or its default when the site has none. A new agent asks you the first time it opens each site. Your answer becomes that site’s rule, so Sval asks once per site instead of on every page.

The levels separate reading from acting. Reading a page changes nothing. Clicking, typing, and submitting can buy, send, post, or delete. So Sval can let an agent read a site freely and still ask before it sends anything. When it asks, it shows what the page is about to send.

Some things Sval asks about separately on each site, because each can reach past the page:

Downloads put files on your computer.
Uploads send files from your computer. Sval allows them only from folders you’ve approved.
Opening another app hands an address to something outside Sval.
A page’s developer console can hold account details, sign-in codes, or what you typed.
A service on this computer or a device on your local network isn’t on the open web, so Sval asks before an agent opens one, whatever the default.

What an agent can’t do

It can’t see or act in a tab outside its own Workspace.
It can’t run its own scripts in a page, act inside frames, or open a file chooser. It sends files only through Sval’s upload question.
It can’t write to your clipboard from its pages.
It can’t read a page’s title or address on a site it isn’t allowed to read.
It can’t complete a check that asks whether you’re human. Sval asks you to take control and do it.
It can’t change its own rules or turn off Be polite. Only you can.

Sval doesn’t hide the agent

Sval doesn’t try to make an agent pass for a person. It tells agents to work at the pace a task needs, with no random delays. Be polite keeps an agent to a set number of actions a second on each site, so it doesn’t overload the sites it visits.