Audit the task, not the technology list.

Start with a real customer goal, not a request to browse the homepage. Record the persona, initial state, immutable prompt, required data, allowed actions, terminal state and criticality. A production run stops before payment, booking confirmation, account deletion or any other irreversible action. A sandbox can continue only with synthetic fixtures and explicit authorization.

Write deterministic assertions before the run. The expected page, database state, cart contents, reservation summary or API response should decide success. The agent's own statement that it finished is evidence to review, not proof of completion.

Verify status codes, redirects, TLS, robots.txt, sitemap entries, canonical URLs and server-rendered critical content. Check whether the agent can identify the authoritative product, policy or support page without relying on a hidden navigation path or a search result snippet that conflicts with the website.

Review headings, internal links, structured data and content freshness together. Inventory llms.txt, llms-full.txt and machine-readable alternatives when present, but do not award readiness merely for publishing a file. The facts must agree with canonical HTML and lead to a usable task path.

Inspect the semantic DOM and accessibility tree for names, roles, values, relationships and state changes. Then complete the task with keyboard navigation and a controlled browser baseline. A visually obvious control can remain ambiguous to an agent when its accessible name is missing, duplicated or detached from the intended action.

Exercise menus, dialogs, forms, validation, autocomplete, focus restoration and live updates. Confirm that errors identify the affected field and provide a recovery step. Cookie banners, popups, CAPTCHA and authentication gates should be measured as part of the path rather than dismissed as setup noise.

Track time from goal delivery to independent final-state verification. Preserve startup, navigation, network, tool waits, retries, policy approvals and unexpected human interventions as separate durations so a slow or fragile path cannot hide behind one average number.

Measure standards-based Cumulative Layout Shift and connect relevant shifts to the nearest agent step. Capture before and after target rectangles when a control moves between perception and action. Keep custom target displacement or action-window movement separate from CLS so the report does not mislabel a useful diagnostic as a web-standard metric.

Detect OpenAPI, remote MCP, WebMCP and other structured interfaces that are relevant to the customer goal. Validate tool names, descriptions, schemas, authentication, permissions, structured errors and final results. A registered tool is useful only when an agent selects it correctly and the underlying business action remains safe and deterministic.

Keep technology inventory separate from outcome scoring. An accessible browser path may pass without an emerging protocol, while a broken MCP or WebMCP implementation can create a new security and reliability finding even when the visual interface works.

Use synthetic identities and controlled accounts wherever possible. Keep credentials, tokens, cookies, payment data, financial records, medical data and direct identifiers out of prompts and report artifacts. Define retention, authorized viewers and deletion rules before recording browser sessions.

Test prompt-injection exposure in untrusted page content, hidden instructions and third-party widgets. The executor should keep website content separate from operator policy, avoid revealing secrets and require an explicit human decision at declared confirmation gates.

End every run with the predefined assertions, then package the prompt, executor profile, timestamps, step trace, screenshots, accessibility evidence, console and network signals, performance data and final state into one reviewable record. Stable IDs and hashes keep the result traceable across baseline and retest.

Classify the primary cause as website, agent-specific, agent policy, infrastructure or inconclusive. Findings should include severity, reproduction steps, expected and observed results, evidence, root cause, remediation, owner and acceptance criteria. Confidence remains separate from readiness when access or evidence is incomplete.