Meta says Muse proposes actions while a separate system, Sentinel, can allow, block or request approval. That creates a permission boundary around the browsing agent without guaranteeing immunity to attacks.