How should browser agents expose control when they use your everyday Chrome profile?

I wanted AI agents to work in the browser session I already use, but direct CDP attachment made one issue feel under-specified: authorization. A browser can grant site access, select a tab, and hold an automation connection, but those are different decisions. In the implementation I ended up separating: site permission, explicit tab authorization, an exclusive control lease for mutations, visible controlled state, immediate revocation. The agent can select among authorized tabs without switching the tab the person is currently viewing. Manual browser use still belongs to the person, and focus never grants the agent more authority. I built this into an open-source project called Panerelay, so this is not a purely theoretical question. I am the author. What I am unsure about is whether the boundary feels intuitive to other agent users. Would you rather approve access once per tab, once per origin, or once per agent session? And what should happen to agent control when a person manually interacts with the page?