Secure mobile AI agents with controls on both sides of the screen
Secure Android AI agents with pairing, app allowlists, protected actions, editable approval, bounded gestures, trace evidence, and fast revocation.
Mobile-agent security requires a trusted pairing, an app allowlist, a restricted gesture interface, protected-action detection, human approval before consequential writes, trace evidence, and immediate revocation. The agent must not be able to expand its own permissions.
Control which device and app can be touched
Bind execution to an explicitly paired device and user session. Allowlist apps by stable identity, not display name alone. Keep administrative permission changes outside the agent's tool surface.
Intercept protected actions on the device
A browser-side confirmation is not enough if the device can submit independently. Detect protected gestures at the execution layer, pause the action, and display the exact draft or operation for approval. Melaya stages detected publishing actions so the operator can approve, edit, or reject them before submission.
- Publishing and outbound messages
- Payments, purchases, and transfers
- Deletion and account changes
- Permission or allowlist changes
- Sensitive copy, paste, or data transfer
Plan for loss, compromise, and drift
Provide device revocation, session expiry, bounded retries, and a return-to-safe-app action. Exclude secrets from screenshots and logs where possible. Review traces after unexpected navigation, repeated approvals, or attempts to leave the allowed app set.
Frequently asked questions
Where should mobile-agent approval happen?
The enforcement point should be close to device execution, with the browser or device UI presenting the exact proposed action to the authorized user.
Can a mobile agent read everything on a phone?
It should not. Access should be limited by Android permissions, the app allowlist, workflow scope, and the state exposed by the current screen.
What happens if the paired phone is lost?
The device association and active sessions should be revoked immediately, and any stored credentials or tokens should be rotated according to the incident plan.
