Webscan Documentation

Lesson 12 · Agentic exploration

Phase 3 · Beyond the public page — Lesson 12 of 21 · All lessons

Objective: understand what agentic exploration is, when to use it, and how to run one safely — letting webscan decide for itself how to move through your site in pursuit of a goal.

Before you start: a website (Lesson 3); ideally a development or staging site, for reasons this lesson makes clear.

What "agentic" means

Agentic — driven by an AI "agent" that makes its own decisions. In an agentic exploration, you don't tell webscan which pages to visit or buttons to click. Instead you give it a goal in plain language, and the AI reads each page, decides the next action itself (navigate, click, type, select, or scan), does it, and repeats — running accessibility checks along the way — until it reaches the goal or runs out of steps.

Compare it to an ordinary scan:

• A scan follows links mechanically.
• An agentic exploration behaves more like a curious human tester: "to reach the goal, I should click Sign up, fill this form, then continue" — discovering pages and states a link-crawler would never reach.

(Its opposite is a journey, the next lesson, where you script every step. Use exploration when you want webscan to figure out the path; use a journey when you already know it.)

When to use it

• To reach pages that only appear after interaction — multi-step forms, wizards, flows behind a button rather than a link.
• To probe a feature by intent ("add an item to the cart and begin checkout") without hand-writing each click.
• For broad discovery when you're not yet sure where the barriers are.

Start an exploration

From the website page, open Agentic exploration and choose Start an exploration. You'll provide:

• Goal — a plain-language description of what to try, e.g. "Register a new account and open the settings page." Be concrete; the clearer the goal, the better the path.
• Mode — how much the agent is allowed to do (see safety below).
• Max steps — a ceiling on how many actions it may take (default 15). This keeps an exploration bounded so it can't wander forever.
• Optionally a scan profile (Lesson 11) so the exploration runs logged in.

Webscan queues the run, then works through it — you can watch its status move Queued → Running → Completed (or Failed, or Blocked by safety). When done, the run shows a summary, whether the goal was reached, each step the agent took, and any findings it uncovered.

Safety: the two modes and blast radius

Because the agent can act on your site — including typing and submitting forms — webscan constrains it. This is the blast radius idea from Lesson 1 made concrete. You choose a mode:

On top of that, even when acting fully, a destructive-action denylist and a credential/payment block apply, so the agent won't do irreversible or sensitive things. Running full actions against a production site requires an explicit acknowledgement — and the safe default is simply: use Read-only on production, Full only on dev/staging.

If a run is Blocked by safety, that's the guardrail doing its job — it tried an action the current mode or the denylist doesn't permit.

What you get back

An exploration's findings are ordinary findings: they appear with their page, elements, and rule, and they flow into verdicts and issues exactly as in Phase 2. Agentic exploration is just another source of findings on the same line you already know.

Tips & pitfalls

• Write goals like instructions to a new tester. "Buy the cheapest product as a guest" beats "test checkout."
• Default to Read-only on anything live. Reserve Full actions for throwaway or staging data — the agent may create accounts or submit forms.
• Keep max steps modest at first. A smaller ceiling gives faster, cheaper runs while you learn what the agent does with your site.
• Read the step list, not just the summary. Seeing the actual path it took teaches you where your flows are hard to navigate — a finding in itself.

Recap

• Agentic exploration gives the AI a goal and lets it choose its own actions to discover and scan interactive pages.
• It's the counterpart to a scripted journey: exploration finds the path, a journey follows one you wrote.
• Two safety modes — Read-only (safe on production) and Full actions (non-production only), with a destructive/credential denylist on top.
• Findings flow into the same verdict → issue workflow.

Try it yourself

On a development/staging site, start a Full-actions exploration with a clear goal like "Create an account and reach the profile page." Watch the steps it takes, then open one finding it produced and give it a verdict.

Previous: ← Lesson 11 · Authenticated scanning Next: Lesson 13 · User journeys →