Before you connect a real account to a self-hosted agent, check what its browser can do under the startup policy.
CopilotKit announced OpenBot 1.0 on November 10. The tagged GitHub release appeared on November 9. The workspace can run locally on Mac or Windows, from source or through Docker. CopilotKit publishes the application source under the MIT license. Model credentials and provider charges are separate. CopilotKit’s release announcement and the version 1.0.0 release.
What the browser policy allows at startup
In the version 1.0.0 architecture document, browser actions pass through a server gateway. It evaluates the configured rules, records a decision, and forwards allowed actions to the agent’s computer. Rules can consider the target host, the type of action, and the tool. Explicit deny rules take priority. Browser action governance at the 1.0.0 tag.
The same document describes two different configurations. An empty policy refuses actions. The policy supplied at startup contains an explicit rule that allows all actions evaluated by that policy. An environment setting or an administrator’s saved policy can replace it. A team looking for a read-only browser needs to configure and verify that boundary before it connects accounts.
What self-hosting covers
The desktop installer bundles the app and its backend. CopilotKit’s description lists centralized administration, boundaries, and audit controls as features of OpenBot for Business. The Business edition can run on the customer’s own infrastructure. CopilotKit describes hosted Business access as early access. Compare the edition and controls you plan to deploy with the tagged code and the vendor’s feature list. CopilotKit’s edition breakdown.
A test that separates reading from submitting
Use a local test page with two actions. The first opens a sample invoice. The second submits an approval to a test endpoint that records each request. Run both through the agent under the proposed policy. The expected result is that the invoice opens and the endpoint records zero approvals. Where your edition exposes the audit log, compare the denied action against the endpoint log. That way you can tell the difference between the agent deciding to stop and the policy actually stopping it.
Repeat the submit attempt after restarting the deployment. If you also grant a connector that can submit invoices, run a separate test through that connector. A browser rule only tells you what happened on the browser path you tested. These are proposed checks based on the published architecture.
Abdessalam Alaoui
I'm Abdessalam Alaoui, founder of Musthave.AI. I write practical guides to AI models, tools, generative media.
