# Take control of an OpenWAF Browsers session from the dashboard

> Admins can open a running browser with keyboard and mouse for 10 minutes to finish a login, a 2FA prompt or a captcha for the agent. Every link is audited, and view-only links are now enforced by the browser service.

The session page (**Browsers › Sessions › Open**) has a **Take control** button for admins and owners. After a confirmation it opens the live view with keyboard and mouse in a new tab: what you type and click goes to the agent's browser, which keeps its CDP connection. Use it when the agent needs a person: a login, a 2FA prompt, a captcha.

- **Short-lived and audited.** Each link is minted when you ask for it, lasts 10 minutes and writes `browsers.session.control` to the audit log with who, the session and the reason. The link itself is never stored.
- **View only means view only.** The `live_url` of the session list and the embedded live view now drop keystrokes, clicks and clipboard at the browser service, not only in the viewer. Members with `tech` or `readonly` get `403` when they ask for control.

API: `POST /v1/orgs/{org}/browsers/sessions/{id}/control`. CLI: `ctl browsers sessions control <id>`. MCP: `browser_sessions_control`. See [Take control](https://developers.openwaf.dev/browsers/reference/#take-control).