🤖 AI

WebRider: Persona-Conditioned Intent Controllers for Live-Web Assistance

WebRider introduces a persona-conditioned intent controller framework that formalizes delegated web tasks as auditable contracts, enabling a hierarchical system to faithfully execute complex live-web policies while ensuring both policy compliance and persona consistency, as validated by the new RiderBench benchmark.

Original authors: Zhi Li, Tao Zhou, Yeqing Li, Eugene Ie, Demetri Terzopoulos

Published 2026-08-10

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Zhi Li, Tao Zhou, Yeqing Li, Eugene Ie, Demetri Terzopoulos

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you're asking a friend to buy you a specific video game. You don't just want the game; you want them to find the cheapest one, make sure it's not a scam, check if it works on your console, and stop searching if the price goes over $50. If your friend just brings back any game that costs $50, they technically finished the job, but they failed your specific instructions. This is the core problem in the world of "AI agents"—computer programs designed to browse the internet and do tasks for us. For a long time, scientists have been obsessed with whether these agents can simply finish a task. But finishing isn't the same as doing it right. If an AI ignores your safety rules or skips important checks just to get to the answer quickly, it's not a good assistant. This paper steps into that gap, asking a harder question: How do we make sure an AI follows your specific "rules of the road" all the way to the finish line, not just the destination?

The researchers behind this study, from UCLA and Google, built a system called WebRider to solve exactly this problem. They realized that current AI agents are like race car drivers who only care about crossing the finish line, even if they drove through a few red lights or ignored the map along the way. To fix this, they introduced a concept called an "Intent Contract." Think of this contract as a strict, written agreement between you and the AI. It doesn't just say "Buy a camera"; it says, "Buy a camera, but only if the seller has good reviews, check the warranty, and if you aren't sure about compatibility, stop and ask me before buying."

WebRider is built like a three-story building to keep these rules safe. On the top floor, a "Controller" acts like a project manager. It holds the Intent Contract, checks the rules, and decides the big strategy: "Keep searching," "Ask the user," or "Stop and give the answer." It never touches the browser directly. On the middle floor, a "Guarded Action" layer acts like a careful translator. It takes the manager's big idea and turns it into one single, safe, tiny move, like "Click this button" or "Type this search." Crucially, this layer is "guarded," meaning it has a built-in safety net that stops it from doing anything weird or breaking the rules. Finally, on the ground floor, an "Executor" actually pushes the mouse and types the keys on the live website.

The team tested this system using a new benchmark called RiderBench, which created over 4,000 different scenarios across 42 real websites. They found a significant gap in how current AI works. A very strong, standard AI controller managed to finish 99.2% of the tasks, meaning it almost always reached an answer. However, when they checked if it followed the "Intent Contract" rules the whole way through, it only succeeded in 38.8% of cases. In other words, the AI was finishing the race, but it was not adhering to the rules more than half the time. It might have bought the wrong item, ignored a safety warning, or skipped a necessary check, all while looking like it did a good job.

WebRider's approach suggests that by separating the "big picture" decision-making from the "tiny click" actions, we can fix this. When they used their new three-story system, the AI didn't just finish tasks; it actually honored the user's specific preferences and constraints much better. They also trained a smaller, specialized AI model just to handle the "middle floor" (the tiny clicks). This model learned to follow the rules so well that it outperformed the standard "do-it-all" models, proving that you don't need a giant brain to make every single click; you just need a clear set of rules and a system that checks them at every step.

The study also brought in human judges to see if the AI's behavior felt trustworthy. They found that even when an AI technically passed all the automated checks, humans often felt the steps it took were risky or confusing. WebRider's system, however, kept the "persona" (the user's specific style and rules) consistent throughout the journey, making humans feel much more comfortable delegating tasks to it. The researchers suggest that for AI to be truly helpful, we need to stop just asking "Did it get the answer?" and start asking "Did it follow the path we agreed on?" By making the path itself a visible, checkable part of the task, WebRider offers a way to build assistants that are not just fast, but faithful.

Technical Summary: WebRider

Problem Statement

Current live-web agents are evaluated primarily on whether they reach a correct final answer. However, this metric fails to capture delegation fidelity: the extent to which an agent adheres to the specific policy (constraints, verification steps, uncertainty handling, and stopping criteria) defined by the user. A plausible final answer can mask significant policy violations, such as ignoring return policies, drifting to incorrect locations, or failing to verify seller reputation.

The paper identifies a critical gap: strong controllers can terminate tasks at high rates (e.g., 99.2%) while honoring all policy constraints in only a minority of cases (e.g., 38.8%). The core scientific challenge is how a browser agent can preserve a task-local policy through every visible step as the web page state changes, without conflating action realization with high-level sufficiency decisions.

Methodology: WebRider Architecture

WebRider addresses this by formalizing the delegated policy as an Intent Contract and enforcing it through a strict hierarchical architecture.

1. The Intent Contract

The contract is an operational record encapsulating:

Goal ( $g$ ): The task objective.
Hard Constraints ( $H$ ): Non-negotiable limits (e.g., budget, location).
Soft Preferences ( $S$ ): User priorities (e.g., "trust-first" vs. "deal-seeker").
Evidence Obligations ( $E$ ): Required data points to be gathered.
Blocking Conditions ( $B_{mat}$ ): Situations requiring clarification or stopping.
Answer Schema ( $A$ ): The required format of the final output.
Persona/Control Policy ( $p$ ): Rules governing search breadth, verification depth, and interaction style.

The contract remains stable unless the user explicitly clarifies the request, ensuring obligations are known before interaction and auditable afterward.

2. Hierarchical Controller

The system decouples long-horizon sufficiency decisions from page-local action selection via three layers:

Top Layer (Controller): Maintains the contract state. It decides high-level strategies: whether to browse, ask, stop, block, or answer. It tracks evidence sufficiency and task finalization but does not generate specific clicks.
Middle Layer (Guarded Action Generator): Maps the current state (contract, observation, history) to a single, atomic, guarded JSON Action AST (e.g., Click, Type, Scroll, Search).
- Guards: A deterministic compiler and helper suite enforce grammar, reject malformed targets, detect blocked states, and attach recovery actions.
- Constraint: This layer is prohibited from deciding evidence sufficiency or final-answer readiness; it only realizes the current intention.
Executor Layer: Executes the actions on the live web (browser, search, maps) and returns observations (screenshots, element labels). It has no reasoning capabilities.

This structure ensures that the "why" (policy adherence) is separated from the "how" (action execution), making the browsing path a first-class, auditable object.

Benchmark: RiderBench

To evaluate this approach, the authors constructed RiderBench, a dataset of 4,096 live-web contracts across 42 public websites and 12 domains.

Construction: 768 audited base tasks were paired with 15 distinct persona policies to create counterfactual scenarios where the request is identical, but the required route differs.
Metrics:
- Contract-Gated Success (CGS): A logical conjunction of five gates: terminal completion, hard-constraint satisfaction, evidence sufficiency, usable answer quality, and absence of unresolved blockers.
- Persona-Consistency Score (PCS): Human evaluation of whether each visible step preserves the persona policy.
- Human-Comfort Preference (HCP): Human raters choose which rollout they would trust to delegate the task to.

Key Results

The evaluation utilized a strong benchmark controller (Full-Pro) and compared it against ablated versions and a learned middle layer (MidSFT-8B).

The Fidelity Gap: The Full-Pro controller terminated 99.2% of contracts but satisfied all contract gates (CGS) in only 38.8% of cases. This confirms that high termination rates do not imply policy fidelity.
Human Acceptability: In a paired human study, the IntentCore approach (binding persona and intention to a persistent state and guarded action) achieved an 86% PCS compared to 70% for the teacher/full controller, resulting in a +42.5% net HCP advantage. Notably, PCS and CGS are correlated but distinct ( $\rho \approx 0.55$ ), indicating that satisfying final gates does not guarantee stepwise acceptability.
Value of Structure: Adding a persistent top state and guarded actions (IntentCore) improved CGS by +5.6 percentage points over a prompt-only controller with the same persona/intention text. This suggests the hierarchical structure itself adds value beyond the information content.
Learnability of the Middle Layer: An 8B action-policy model (MidSFT-8B) trained on the guarded middle interface achieved 50.8% CGS and 78.1% evidence coverage under a fixed top layer. This significantly outperformed executable-only baselines (32.9% CGS), demonstrating that the guarded interface provides a high-quality, learnable target for action realization without needing to retrain the entire controller.

Significance and Claims

The paper claims three primary insights:

Path Matters: High termination rates can coexist with low contract fidelity; the route taken is as critical as the final answer.
Human Judgment Diverges: Final gates do not fully capture stepwise acceptability; human raters reject trajectories that satisfy the final answer but violate intermediate policy constraints.
Trainable Interfaces: Guarded middle traces provide a reusable, learnable action interface. By decoupling action realization from finalization decisions, it becomes possible to train policy models that are auditable and human-judgeable without conflating action selection with evidence sufficiency.

WebRider does not claim to solve private memory or long-term contract inference, nor does it resolve CAPTCHAs or access-policy blocks. Instead, it provides a controlled framework to make missing delegation fidelity observable and to test, audit, and learn the specific routes that produce answers.