The guard that stops our automation from following a link

Description and use

A guard that blocks automated workflows from following redirects to third‑party sites by checking registrable domains (eTLD+1) during recording and replay, preventing unintended account creation and ensuring safe, auditable automation.

Problem

Automated form‑filling workflows can unintentionally navigate to third‑party sites that require account creation, payment, or other actions, leading to unintended account creation and data leakage.

Outcome

The guard prevents automated workflows from following redirects to external domains, ensuring that only safe, same‑site interactions are executed and reducing the risk of unintended account creation.

Workflow

• 1. User records a reply flow on the aggregator site.
• 2. During recording, any step that navigates to a different registrable domain is flagged and not recorded.
• 3. On replay, the guard checks the current URL’s registrable domain against the original domain.
• 4. If the domains differ, the guard triggers an "offsite" block and aborts the replay.
• 5. The user is notified of the specific guard that tripped.

Evidence

Guard at the point data enters the system, not only at the point it is used. A recorded artifact is a persisted decision, and persisting a dangerous one and relying on downstream checks means one missed check turns into a repeatable incident.

Source

Every rule here is deterministic and runs before anything is typed or clicked. None of it is delegated to a model — the whole point is that the refusals are predictable and auditable.

Source