Playwright's locator.click() runs four checks before it fires. The element must be visible: non-empty bounding box, no visibility:hidden. It must be stable: same bounding box across two consecutive animation frames. It must be enabled: not a disabled form control, not inside a disabled fieldset. And it must receive events, meaning a hit-test at the action point confirms nothing is intercepting the pointer. WebDriver's Element Click does parallel work. Scroll into view. Compute the in-view center point. Verify the element is first in paint order at that coordinate. If something sits on top, element click intercepted. If the element is outside the viewport, element not interactable.
This is genuinely good engineering. Years of edge cases, compressed into a sequence that handles animation timing, DOM mutation, viewport geometry, and z-order obstruction without the caller thinking about any of it. People built this with care, and it shows.
It is also the least important part of whether an automated action counts.
What the click doesn't carry
The actionability stack answers a geometric question: can this event land on this element right now? That's it. It does not know whether the page state was fresh when the agent decided to click. It does not know whether the principal who authorized the agent still wants this action taken. It does not know whether the site on the other end considers the actor legitimate. And here's what kills me: remarkably little infrastructure exists for any of these.
The absence has the same shape everywhere you look. Systems that standardize reaching the action without standardizing the authority behind it. MCP's tools/call schema is a tool name plus arguments. The result is content, an error flag, and optional metadata. No standard fields for mandate. No credential scope. No approval chain. No revocation. Authorization is explicitly optional for stdio transports. The protocol standardizes discovery and invocation with real care. Governance is someone else's problem.
Meanwhile, on the receiving end, Cloudflare now classifies bot traffic into Search, Agent, and Training categories with per-category mitigation controls. New domains will default to blocking Agent and Training traffic on ad-bearing pages starting September 15. The counterparty is already deciding whether to recognize the actor. But the click carries none of that context. The site has to infer intent from request patterns, and "inference" is a polite word for guessing.
The one domain where the governance furniture is actually being built is payments. Visa's Intelligent Commerce framework binds payment tokens to specific agents, validates credential requests against the user's original authenticated instruction, and carries that instruction forward into dispute resolution. Their Trusted Agent Protocol adds signed credentials with eight-minute expiration windows and separate signature tags for browsing (agent-browser-auth) versus payment (agent-payer-auth) interactions. Because "looking at a product page" and "submitting a purchase" are different institutional acts even when the HTTP requests look similar. That is four integrated services built to answer questions the click layer doesn't even know how to ask.
Why the gap persists
Payment networks built this because disputes forced them to. When a cardholder calls their bank, "a click occurred" is not a resolution category. You need to show who authorized the action, within what boundaries, and whether the outcome matched the instruction. The artifacts that survive a challenge ARE the real specification of what happened. Everything else is atmosphere.
Most agent infrastructure faces no equivalent forcing function. The reason is structural, not mysterious: the consequences haven't been severe enough to generate institutional disputes at scale. An agent that browses a product page and gets blocked doesn't produce a chargeback. An agent that summarizes an article incorrectly doesn't trigger a regulatory filing. The failures get absorbed silently, retried, shrugged off. Payment networks are building first because money changes hands with contractual obligations attached, and when those obligations are contested, someone has to produce a record proving the action was authorized, bounded, and intentional.
Until other domains develop their own version of that pressure, the click keeps landing, the action keeps completing, and the entire stack above the mechanical layer stays remarkably thin.
- MCP auth in practice: A May 2026 measurement study found that 40% of 7,973 live remote MCP servers expose tools without authentication, with at least one OAuth flaw in every testable server that attempted it.
- Agent fingerprinting is easy: A June 2026 preprint reported that while some web agents bypassed anti-bot mechanisms, all evaluated agents could be distinguished from humans using network, HTTP, and browser fingerprinting.
- Traces aren't records: A June 2026 paper argues that audit logs and execution traces can be identical under multiple incompatible delegation assignments, making mandate reconstruction structurally underdetermined from ordinary telemetry alone.
- Mastercard's parallel move: Mastercard's Agent Pay framework requires registered and verified agents with consumer controls over purchasing scope, showing that the governance pattern extends beyond a single payment network.