A logged-in session is a credential
A browser session can represent access even when no password is visible. Playwright explicitly warns that saved authentication state can contain cookies and headers usable to impersonate an account. Treat session files, remote connection URLs, screenshots, and downloaded account data as part of the credential review.
Our editorial starting point is a dedicated automation identity where the application supports one. Give it only the records and actions required by the workflow. Reusing an owner’s everyday browser profile mixes unrelated access into the run and makes it harder to explain which authority the agent actually had.
Separate login from task reasoning
Use an approved authentication path and keep raw secrets out of prompts and ordinary logs. A person may complete MFA or a security challenge through a controlled handoff. The task should resume only after the application verifies the intended account and authorized scope; seeing a dashboard is not sufficient if multiple organizations share the same login.
A secure design needs an explicit policy for persistent sessions. Record which user or tenant owns the state, where it is stored, how access is controlled, when it expires, and who can revoke it. Do not reuse one stored session across unrelated customers because the browser tool makes it easy.
Protect the observation trail
Screenshots can contain names, balances, recovery codes, or private messages. Debug traces may contain request headers and form values. Limit what is captured and set retention for what remains. Keep operational receipts useful by storing references and redacted metadata instead of every secret-bearing payload.
Before deploying, search test artifacts and logs for the synthetic secrets used in your test environment. Check failure traces as well as successful runs. Errors often take a different logging path. Confirm that exported recordings cannot be viewed through a broadly shared link without the intended access controls.
Exercise revocation and recovery
Expire a test session during a run and confirm that the job stops or requests reauthentication. Rotate a test credential and prove that old workers cannot continue using it. After an account owner revokes a task, remove persistent session state and any scheduled retries that would recreate access.
These are proposed operational checks, not a claim that a specific vendor stores credentials in a particular way. Look for first-party security documentation and account-specific contract terms when selecting infrastructure. When public evidence does not establish a retention or access-control detail, record it as unknown and resolve it before handling sensitive production data.