Echoes

Echoes

What the Click Was Holding Together

A mouse click is four assertions compressed into one gesture: I'm here, I see what I'm doing, I have the authority, and I mean to do it now. Nobody needed to name those components separately, because a person was always holding them together. Audit logs, session tokens, approval workflows — all built on the assumption that the click was self-interpreting. Now software can reproduce the gesture perfectly while the meaning doesn't arrive with it. The screen can operate. It cannot testify.

What the Click Was Holding Together
A mouse click is four assertions compressed into one gesture: I'm here, I see what I'm doing, I have the authority, and I mean to do it now. Nobody needed to name those components separately, because a person was always holding them together. Audit logs, session tokens, approval workflows — all built on the assumption that the click was self-interpreting. Now software can reproduce the gesture perfectly while the meaning doesn't arrive with it. The screen can operate. It cannot testify.
CAPTCHA Sidebar

The W3C defines CAPTCHA as a "Completely Automated Public Turing Test," built to tell computers and humans apart. That framing made sense when the threat was a script trying to scrape a form or stuff a ballot box. Human or not. Binary gate.
Browser agents walk right through that binary. They click, scroll, and type across the same surfaces CAPTCHA was designed to police. Some operate on behalf of a real person with a real account. The checkbox has no way to know that, because it was never built to ask.
NIST's authentication guidance already treats cloud IPs and unusual geolocation as fraud signals rather than proof of anything. Cookies track sessions but aren't authenticators. Access tokens don't prove presence. The infrastructure around the gate has quietly moved past the question the gate still asks.
CAPTCHA is a witness who can tell you someone showed up. It can't say who sent them, what they're allowed to do, or whether anyone will account for what happens next.

The 3am Screenshot That Revealed the Bot Was Never Really Inside the System
CONTINUE READINGMechanics and Money

The Click Was Never Simple
Playwright's auto-waiting documentation lists five preconditions that must be satisfied before a click executes. Attached. Visible. Stable. Receiving events. Enabled. A person resolves all five in a glance without noticing. Written out for a machine, they read like a catalog of everything that's ever gone wrong with a button.

Money Complains in Structured Formats
Visa, Mastercard, and Stripe are building agent payment infrastructure. The revealing detail is what happens when a purchase goes wrong. Chargebacks demand structured evidence, and structured evidence forces a distinction most web automation has never needed: the difference between performing an action and being authorized to perform it.
Further Reading




Past Articles

In 1986, IBM shipped a tool that let programs read characters off a terminal screen because mainframe applications had n...

In June 2018, the W3C published a spec describing software that "emulates the actions of a real person using the browser...

In 2004, a developer at ThoughtWorks wrote a JavaScript tool to stop his colleagues from manually clicking through a bil...

RPA's governance problems didn't arrive all at once. They accumulated quietly: orphaned bots running on departed employe...
