Build Browser AI Lens: The User-Owned Intelligent Browser

A platform decides what enters a feed, how it is ranked, which controls are prominent and which forms of automation are available.

The user may select among the settings the platform offers. That is not the same as controlling the interface.

The preceding chapters built the machinery for another layer: software acting locally, under rules the user can inspect, across sites and independently of one model provider. This chapter assembles that machinery into one product, Browser AI Lens, and states precisely what has been demonstrated and what has not.

1. What we have built

The Lens is not a new runtime. It is a composition surface over four locked substrates:

Admission Runtime        — structured proposals admitted or rejected
Authority Runtime        — exact-effect, single-use, expiring grants
Context + Policy Runtime — bounded retrieval, provenance, portable policy
AI-Origin Filter         — the first policy application, from Chapter 23

Each substrate is implemented and regression-tested independently. The Lens imports them. A source-level guard in the Lens test suite rejects any reimplementation of admission, policy compilation, grant minting or consumption, retrieval bounds, lease handling, or worker matching inside Lens code. That guard is the architectural freeze made executable: the product may compose the substrate, never duplicate it.

2. Four modes, one runtime

The Lens deliberately refuses the generic chatbot shape. It exposes four visibly distinct kinds of intelligence:

UNDERSTAND  — interpret and explain using browser AI
EXPLORE     — retrieve and amplify bounded sourced evidence
GOVERN      — apply user-owned policy to presentation
ACT         — propose and execute typed effects through boundaries

The distinction is the product. A chat box would hide which of these is operating; the Lens keeps the kind of operation visible, because each kind carries different obligations around evidence, policy, and authority.

                         USER
                          │
                   Browser AI Lens
                          │
        ┌─────────────────┼─────────────────┐
        │                 │                 │
        ▼                 ▼                 ▼
   Understand          Explore           Govern
        │                 │                 │
        └─────────────────┼─────────────────┘
                          │
                        Act
                          │
                     proposal
                          │
                     admission
                          │
                       policy
                          │
                      authority
                          │
                    coordinator
                          │
              Observatory extension worker
                          │
                   Chrome Canary
                          │
                     browser AI
                          │
                    Observatory

3. Assemble the Lens

The integrated surface holds one stable UI state — selection, active mode, result, evidence, decision, execution, inspect, and a status drawn from idle, running, awaiting-approval, completed, and failed. Every mode projects into that state through the same overlay orchestration a reader would use; there is no separate demonstration path. Errors remain explicit rather than collapsing into a generic failure message.

4. Understand

Understand takes the current page, selection, URL, and metadata and runs one of six bounded commands — summarize, explain, translate, compare, extract claims, challenge claim — as a validated Prompt job through the existing browser worker. Prompts are bounded to the worker’s 1–2000 character contract, the provider and data boundary are recorded, and the result renders with its trace.

Understand is interpretation. It performs no retrieval, and the chapter makes no grounded-research claim on its behalf. Its Inspect view carries intent, runtime, result, and trace — and no policy section, because none was involved.

5. Explore

Explore crosses from the current page to bounded external context without inventing another retrieval engine. The locked retrieval boundary runs first — document and unit limits, byte and estimated-token budgets, privacy exclusion, provider data boundary, content-hash verification — and only admitted units proceed. The Lens then ranks those units with a deterministic term-overlap scorer and packs a bounded evidence set: per-section caps, a total cap, top-K bounding, deduplication, and deterministic ordering. Oversized or prohibited material is excluded with an explicit reason, never silently admitted.

Every record retains its provenance:

sourceId
sourceUrl
title
content
contentHash
retrievedAt
score

so Inspect can answer which source the Lens actually used rather than which topic it vaguely associated. The implementation is verified to retrieve admission-related material for the claim “a resolved promise is not a correct answer,” and the tests assert system behavior and lineage rather than model prose.

6. Govern

Govern is orchestration over the Chapter 23 filter, unchanged. The evidence ladder — verified-ai, declared-ai, likely-ai, unknown, verified-non-generative-workflow — feeds the portable policy runtime, which returns a decision class distinct from the concrete action: transform with blur is not decision: blur, and require-approval names an outcome, not an execution.

Under the standard policy, the deterministic specimens resolve as implemented and verified:

verified-ai   → transform → hide
declared-ai   → transform → hide
likely-ai     → transform → blur
unknown       → unknown fallback → show
verified-non-generative-workflow → show

The strict policy treats classifier resemblance more conservatively: a likely-ai signal earns no blur, because resemblance is not provenance. Same evidence under two versioned policies produces two different presentations — the user, not the platform, controls the interface, expressed as data rather than as settings prose.

Limitations travel with the verdict. A likely-ai rendering carries resemblance-is-not-provenance and probabilistic-only into Inspect; an unknown rendering carries its absent signals. Uncertainty is displayed, not laundered. Every transformation is reversible, and whole-policy undo is implemented and verified.

7. Act

Act composes the full boundary chain for one deliberately simple operation, a typed Prompt execution:

proposal
   ↓
admission
   ↓
policy → require-approval
   ↓
awaiting-approval, externalEffects = 0
   ↓
external exact grant
   ↓
coordinator submit → lease → START (grant consumed here)
   ↓
Canary extension worker → Prompt API
   ↓
result → Inspect

The critical invariant is preserved at the product boundary: Act never mints authority. The first call stops with the exact effect and its digest exposed for approval; only an externally created grant permits execution. Consumption happens inside coordinator.startJob, where Lock 4 placed it — Act never consumes directly. Mutation is denied on digest mismatch, replay is denied as already-consumed, and denied paths never reach the browser API. Each property is verified by tests that run the real authority and coordinator machinery.

8. Inspect the decision

Inspect is a projection of existing lineage, not another model or debugger. Nine frozen sections — intent, evidence, policy, decision, authority, execution, runtime, result, trace — appear asymmetrically by mode, which reflects reality rather than forcing a generic shape. The Act view is the richest: proposal, admission stages, policy version, exact authorized effect with digest, grant identity and consumed state, job, worker, lease attempt, Canary runtime, result, and a causal trace ordering with raw events retained underneath.

9. Run the full scenario

One scenario driver, browser-ai-lens/golden.js, exercises the finished UI end to end and is shared by deterministic testing and live evidence alike:

"A resolved promise is not a correct answer."
   ↓
UNDERSTAND explains the claim
   ↓
EXPLORE retrieves bounded chapter evidence
   ↓
GOVERN blurs a likely-AI specimen, then undoes it
   ↓
ACT proposes the experiment, stops for approval,
   is granted exactly once, and completes
   ↓
Observatory validates the trace

The deterministic run is implemented and verified: selection survives every stage, chapter evidence ranks and retains provenance, Govern demonstrates transform plus undo, Act stops before approval and completes after it, single use holds, and the trace validates. The live run against Chrome Canary is specified by the same driver and has an honest runner that records partial state when the worker is unavailable.

Evidence status at the time of writing: the deterministic golden composition is verified by test; Lock 4 live Canary evidence separately demonstrates the authority boundary in production — an authorized Prompt completing, a replayed grant denied before execution, and a mutated effect rejected on digest mismatch, all in one validated trace with prompt reported available. A completed full-golden live run, with the Lens observing LENS_GOLDEN_OK from the real Prompt API, remains pending and must not be claimed until its artifact exists. Recent live attempts recorded worker-unavailable partials, which are valid observations of absence rather than capstone evidence.

10. What the model does not control

The architecture assigns each concern to the party that can actually guarantee it:

Capability is runtime state, not a browser feature flag: live Canary profiles have shown prompt, summarizer, and language detection available while writer, rewriter, proofreader, and WebMCP were absent. The capstone therefore never depends on WebMCP being present.

11. The browser as a user-owned AI runtime

The book began by asking how to call a model in Chrome. It ends with an assembled answer: a Lens in which AI may perceive, synthesize, and propose, while evidence selection stays bounded and inspectable, policy stays explicit user-owned data, authority stays separate from proposal, execution stays typed, effects stay correlated to exact single-use grants, and every step stays observed.

That future is not automatic. The manuscript’s earlier warning stands: platform-mediated outcomes arrive by default, and user-governed ones have to be engineered. What this chapter adds is that the engineering now exists, in one place, with its lineage exposed:

Intelligence is useful. Inspectable intelligence is a system.

The Observatory gives us a way to build that system, measure it, and revise it when the evidence changes — beginning, as always, with what the trace actually says.

Sources and further reading

1. W3C, WebExtensions Community Group.
2. Chrome for Developers, Extensions platform documentation.
3. Coalition for Content Provenance and Authenticity, C2PA specifications.
4. Browser AI Lens implementation, experiments/browser-ai-from-first-principles/browser-ai-lens/.
5. Golden scenario driver, experiments/browser-ai-from-first-principles/browser-ai-lens/golden.js.
6. Lock 4 live authority evidence, experiments/browser-ai-from-first-principles/runtime/evidence/lock4-authority-extension-2026-09-07T21-01-10-804Z.summary.json.