An agent task has no code of yours. Our agent loop drives the browser toward a goal you write, with the model you choose, called through OpenWAF Egress. Like a script, it can read freely and can only propose writes.
Before you start
- Access to OpenWAF Tasks and a browser key. See get access.
- OpenWAF Egress enabled, with a provider credential on the target you will use, for example
openai. See targets and keys. - An organization-wide
admin.
1. Create the task
| Field | Meaning |
|---|---|
agent.goal | What to do, up to 4000 characters. Say what to read, what to report and what, if anything, to propose. |
agent.egress_target | The Egress target the model calls go to; it must have a credential |
agent.model | The model name at that target |
agent.max_steps | Tool calls of the agent per run, 1 to 50 (default 25) |
allow | Domains the browser may visit |
curl -sS -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/tasks" \
-H "Authorization: Bearer $OPENWAF_TOKEN" -H "Content-Type: application/json" \
-H "X-Change-Reason: Weekly docs review" \
-d '{"name": "docs-review", "kind": "agent",
"schedule": {"cron": "0 8 * * 1", "timezone": "Europe/Madrid"},
"browser": {"key_id": "'$KEY_ID'", "profile": "", "recording": true},
"allow": ["example.com", "*.example.com"],
"agent": {"goal": "Open https://example.com/docs/ and its linked pages. Report broken links and pages that contradict each other as the output. Do not propose any action.",
"egress_target": "openai", "model": "gpt-4.1-mini", "max_steps": 30},
"max_run_minutes": 15}'OpenWAF creates an Egress agent for the task, named task- and 8 hex digits (egress_agent in the task). Its calls appear in the Egress events like those of any other agent.
2. What the agent can do
The agent sees the page as text and screenshots and uses these tools: navigate, click, type, read, take a screenshot, log, set the output, and propose_action. propose_action takes the same summary, target and steps as a script's task.approve. It can propose up to 5 actions per run.
Page content reaches the model marked as untrusted data, and the model is told never to follow instructions from pages. Even if it did, it cannot write: see prompt injection.
3. Run it and review
Run it now (POST /v1/orgs/{org}/tasks/{task}/run) and open the run: logs, screenshots, output, model_calls, prompt_tokens and completion_tokens. If it proposed an action, review it in Tasks → Approvals as in the script quickstart.
A run stops when the agent finishes, after max_steps tool calls or after max_run_minutes, whichever comes first (timed_out for the last one).