AI & Technical question

How would you design guardrails for OpenAI's Operator (browser agent) to prevent harmful actions?

Practice this question out loud. An AI interviewer asks it, follows up like a real interviewer would, and scores your answer. Type or speak.

What this question tests

AI safety and product design judgment for an agent that can take real, irreversible actions on the open web.

Segment actions by reversibility and risk: read-only browsing, form-filling, and high-risk actions like purchases or sending messages.
Propose a permission model: low-risk actions run autonomously, high-risk or irreversible actions require explicit user confirmation before execution.
Design guardrails against prompt injection from malicious web content, since Operator reads pages that can contain hidden instructions.
Propose a visible action log so users can review and interrupt what the agent is doing in real time, not just after the fact.
Define success: rate of harmful or unintended actions caught before execution, and user trust measured by opt-in rate to autonomous mode.

Names prompt injection from untrusted web content as the specific, realistic attack vector, not a generic safety concern.
Proposes a clear tiered confirmation model, distinguishing browsing from financial or irreversible actions like clicking buy.
Suggests a real-time visible action trace so users can stop the agent mid-task, not just review after the fact.
Proposes a candidate metric, like percentage of high-risk actions correctly routed to confirmation, targeting close to 100 percent, marked as an assumption.

Treating all actions with the same level of friction, which makes the product either unsafe or unusable.
Ignoring prompt injection as the primary novel risk specific to a browsing agent.

How would you detect a prompt injection attempt in real time?
What would you do if a user complains the confirmation prompts are too frequent?