The Traditional Problem
Integrating AI agents with enterprise applications typically requires:- Service accounts — Privileged accounts that act on behalf of users
- OAuth flows — Users re-authenticate to grant the agent access
- Token management — Refresh tokens, expiry handling, secure storage
- Elevated permissions — Service accounts often have broader access than any individual user
Char’s Approach
The agent inherits the user’s existing session: The key insight: WebMCP tools execute in the browser tab’s context. When a tool callsfetch(), it uses the user’s existing cookies and session.
Security Properties
Permission Parity
The agent has exactly the permissions the user has:| User Permission | Agent Permission |
|---|---|
| Can view records | Can view records |
| Cannot delete records | Cannot delete records |
| Read-only on financials | Read-only on financials |
Session Lifecycle
When the user’s session ends, the agent’s access ends:- Logout — Agent loses access immediately
- Session timeout — Agent cannot make calls
- Permission change — Agent sees new permissions immediately
Audit Trail
All agent actions appear as the user in your existing audit logs:Why This Works
Browser as Authentication Layer
The key insight is that WebMCP tools execute in the browser tab’s JavaScript context—the same context where the user is already authenticated. When a tool makes afetch() call, the browser automatically attaches session cookies. No code is needed to “pass” credentials; the browser handles it.
This is fundamentally different from server-side agents, which must obtain and store credentials separately from the user’s browser session.
Standard Web Security Model
Session inheritance doesn’t bypass or modify web security—it relies on it:- Same-origin policy — Tools can only call APIs the page can reach
- Cookie scoping — SameSite and HttpOnly attributes work as designed
- CORS enforcement — Cross-origin restrictions apply normally
For implementation details, see the WebMCP Tools guide.
Comparison: Session Inheritance vs Service Accounts
| Aspect | Service Accounts | Session Inheritance |
|---|---|---|
| Permissions | Often over-privileged | Exact user permissions |
| Credential storage | Required | None |
| Token management | Required | None |
| Audit attribution | Service account | Actual user |
| Session lifecycle | Independent | Tied to user |
| Setup complexity | High | Zero |