Would an agent be allowed to click this?

The classifier normalises the label, lower case with whitespace collapsed, and compares it against a phrase list ordered from most specific to least. The first phrase found decides the effect. German phrases come first in the list because the portals Browserberg was built for are German, and the English set follows. A label that matches nothing is read or submit, and neither is ever blocked.

The element, not the instruction

The gate runs after planning and looks at the label of the element about to be acted on, never at what the user asked for. That is deliberate. A page cannot rewrite a customer's instruction, but a page can put a button labelled Konto löschen exactly where a planner looking for Weiter will find it. Classifying the element means an injected control is caught by what it says it does, regardless of how the plan came to include it. Typing into a field is never gated: filling a form is reversible until something is submitted, and the submit control is what gets classified.

Three policies

With refuse, the safe default, a high-risk step is not taken and the run reports which step was refused and why, with the matched phrase. With propose, the step is returned for a person to approve, which is how a workflow that legitimately ends in a purchase is meant to work. With allow, everything runs, which is a per-tenant decision made explicitly rather than a flag a prompt can flip. The tool shows all three outcomes for the label you entered.

The mojibake repair

Some German portals serve UTF-8 bytes declared as windows-1252, so löschen arrives in the DOM as löschen. Before matching, the classifier tries to re-decode the label as that mistake; a label that was never mojibake fails to re-decode or produces nonsense and is left alone. The gate that refuses account deletions must not be beaten by a charset header, and the tool shows when the repair changed the input.

What the classifier does not judge

It matches words, not consequences, and it is tuned to over-refuse. Filter entfernen matches entfernen and is classified destructive, which is a false positive by design: a refused filter reset costs a retry with a person in the loop, a permitted account deletion costs an account. The classifier also knows nothing about context. A Kündigen link in a footer menu and the final Kündigen button on a confirmation page classify the same, and whether the click actually ends a contract is something only the page knows. It does not read the element's surroundings, its form, or the page it leads to; that is the destination guard's job. And it is not a content policy: a label in French or Polish that carries the same meaning matches nothing and passes as read, which is why the list is public and grows with the portals customers bring.