A traditional RPA bot could only click what its selector map named: a specific button ID, a fixed screen coordinate, a named UI element in a specific application version. That was tedious to build and brittle to maintain, but it had one underrated property — it was a hard boundary. An agentic process replacing that bot with an LLM that reads the screen and decides where to go has no such boundary by default. AI Agent Allowlist is the page-type policy layer that restores it: a verified map of 28 page types across 40M+ domains that tells your migrated workflow exactly which pages it may enter and which it must never touch, regardless of how the underlying application changes.
This page is written for the RPA vendor's product and delivery teams planning that migration — not the end customer clicking through a workflow, but the people deciding what the replacement automation is and is not allowed to do before it ships.
The 2026 agent incidents are a preview of what unbounded automation looks like at scale — a hijacked wiki absorbed roughly 15,000 automated edits through legacy write endpoints, precisely the kind of surface a selector-scoped bot would never have reached, and an agent with no equivalent boundary did.
every 2026 agent escape, mapped to the rule that stops itIt is easy to think of selectors purely as the thing that made RPA brittle — a bot broke every time a button moved. That framing misses what selectors also did: a bot with a selector map for “click Submit Invoice” could not, even if something went wrong, wander off and click “Delete Account” instead. The selector map was the bot’s entire vocabulary of possible actions. Replace that bot with an agent that reads a screen or a page and decides what to do next, and you gain enormous resilience to UI change — and lose the vocabulary limit that came bundled with the old approach, whether anyone budgeted for that trade-off or not.
The four-layer model behind that policy — a page-type database, egress rules, a high-value host list and default-deny — is documented in full on the agent guardrails page.
A selector-based bot could only perform the specific actions someone had explicitly wired into it; an LLM-driven agent can, by default, navigate to and attempt to act on any page it can reach — which means the thing that used to be true by construction (this bot cannot touch checkout, cannot touch login, cannot touch admin) now has to be true by policy, enforced separately, or it stops being true at all.
Page-type policy is the direct replacement for that lost boundary: instead of a selector naming the one button a bot may click inside one application, a page-type rule names the categories of page an agent may enter across any site it happens to reach — product and documentation pages allowed, login and checkout pages denied, by default, everywhere.
This is worth spelling out because “the agent is smarter, so it doesn't need selectors” is a common but misleading way to describe the migration internally. The agent being more capable is exactly why it needs an external boundary: a selector map's rigidity was never really the safety feature people relied on, it was a side effect of how narrow the bot's vocabulary happened to be. Remove the narrowness without replacing the boundary, and what is left is a system more capable than its predecessor with fewer guarantees about what it will do, not more.
The table below is the honest comparison a migration plan should be built around — not “agentic is strictly better,” but “agentic trades one kind of control for another, and the second kind has to be added back deliberately.”
Framing the migration this way changes the pitch a vendor makes to its own customers. “More flexible, more resilient to change” is true and worth saying, but a security-literate buyer's next question is always about what got traded away to get there. Leading with the answer — here is the replacement boundary, and here is what it covers that the old one did not have to think about — is a stronger position than waiting for the question and improvising an answer during a renewal conversation.
| Property | Selector-based RPA | Policy-based agentic automation |
|---|---|---|
| What defines the action boundary | A hardcoded selector map: exact element IDs, XPaths, screen coordinates | A page-type policy: allow/deny rules over categories of destination, evaluated per URL |
| Resilience to UI change | Breaks the moment a button moves or an app updates | Unaffected — the agent reasons about the page, the policy reasons about the page type |
| What happens on an unexpected screen | The bot fails closed — no matching selector, no action | The agent may attempt anything unless a policy explicitly denies it — fails open without one |
| Coverage across new applications | Zero, until someone builds a new selector map for each app | Immediate, if the destination is one of the 40M+ domains already classified by page type |
| Credential & payment surfaces | Untouched only because nobody wired a selector to them | Untouched because login, checkout, cart and signup are denied by default, by page type, on any domain |
| Auditability | Action log matches the selector map 1:1 — simple but rigid | Navigation log records page type and rule fired per request — flexible and still deterministic |
These six questions come up in almost every migration conversation, in roughly this order, because each one is a customer testing whether the new system's guarantees actually replace the old one's, not just its capabilities.
The question every customer who trusted their old selector map eventually asks about the new agent. The honest answer needs to be a policy, not a promise.
Selector-based logs were simple because the action set was small. An agent's navigation log needs the same clarity: page type, rule, and result per request.
Selector maps were built per application. A page-type policy travels with the destination, not the source app, so it works the same across every site the agent reaches.
Selector maps were approved implicitly, one wiring session at a time. Policy needs an explicit owner and a written default-deny baseline before rollout.
A selector-based bot simply couldn't reach an unanticipated site. An agent can, and the policy answer is default-deny for anything outside the classified map.
One page-type lookup per navigation, resolvable from a local database copy at effectively zero added latency — the policy check is not the bottleneck.
Inside an RPA vendor, “how do we scope the new agent” is not one team's question — it shows up differently depending on where in the organization it lands, and a migration plan that only answers it for one of the three below tends to stall when it reaches the others.
Deciding whether page-type policy ships as a built-in default in the platform itself or as a configuration option customers opt into. Shipping it as a built-in default is the stronger security posture and the easier support story; making it optional shifts the decision, and the risk, onto every individual customer, most of whom have no particular reason to think about it until something goes wrong.
Doing the actual per-customer work of turning an old selector map into a page-type baseline. This is where the migration-path steps on this page get executed process by process, usually starting with the highest-volume or highest-risk workflow first, since that is where a gap in the new policy would be noticed fastest.
Fielding the question every migrated customer eventually asks: “what stops this from doing something our old bot never could?” Having a written policy and a navigation log to point to turns that conversation from a reassurance into a demonstration, which closes it faster than a verbal assurance ever does.
Vendors migrating a customer base rarely do it all at once. The sequence below mirrors how a phased rollout typically goes, one process at a time, and it deliberately front-loads the audit step because everything after it depends on an honest inventory of what the old bots actually did.
Every action a legacy bot could take is a data point on what the new agent should be allowed to do — and, just as usefully, everything it was never wired to touch.
Map each legacy action's target screen to the equivalent page type: an invoice-submission bot's targets are commerce and documentation types, never identity or admin types.
Start narrower than the old selector map, not wider — identity, payment and write-page types denied everywhere until a specific exception is justified.
One GET per candidate navigation, or a local database copy for zero added latency on the automation's critical path.
Compare the new navigation log against the old selector map's action log before extending the policy to the next process.
The illustrative before/after below is deliberately simple — a real migration's policy file will carry more rules and more per-customer tuning, but the shape of the translation is the same regardless of how large the original selector map was.
The last line is the important one for anyone used to selector-based thinking: unclassified_domain: deny is the policy equivalent of “no selector, no action.” It restores the fail-closed behavior a selector map gave you by construction, applied to a much larger and more flexible action space.
Notice also what did not survive the translation, and should not: application-specific detail like screen names and version numbers. A selector map had to be rebuilt every time the underlying application shipped a new release; a page-type policy has no such dependency, because it reasons about the category of destination rather than the pixel layout of a particular screen. That is a genuine improvement a vendor can point to, distinct from and in addition to the safety boundary restored above it.
RPA platforms embedding this as a built-in guardrail for every customer's migrated workflows typically look at OEM terms rather than a per-seat API plan; full one-time database licenses run $14,999 for 10M domains, $24,999 for 15M, $49,999 for 30M, with an optional refresh at 30% of the license price per year. See pricing for self-serve tiers, or contact us for OEM terms. Platforms wanting general domain-category data alongside page types can pair this with our sibling database at webfilteringdatabase.com.
Start with the free sample, then talk OEM terms for embedding page-type policy across your customer base.
