I have spent twenty years watching systems report success. Green checkmarks. 200 responses. Tests passing. And the hardest operational lesson I know, the one that took me the longest to learn, is that "it worked" and "it did the right thing" are completely different statements. The gap between them is where every interesting incident I've ever investigated actually lives.
Browser automation learned this lesson one layer at a time. The learning is worth tracing, because it reveals a silence that's about to become very, very expensive.
Selenium showed up in 2004 as a testing tool that injected JavaScript directly into the browser to simulate user actions. It clicked things. Sometimes those things were hidden behind overlays, scrolled off-screen, hadn't finished rendering. Selenium reported success anyway. The browser had a different opinion about what had actually happened. (If you've ever debugged a flaky test suite at 1 AM, you know exactly this feeling. The tool is confident. Reality is not.)
The W3C WebDriver spec set out to fix this, moving from a first public draft in 2012 to a full Recommendation in 2018. The fix was mechanical and exacting. Before dispatching a click, WebDriver scrolls the element into view, calculates its in-view center point, checks whether another element obscures that center point (returning element click intercepted if so), and confirms the target is inside the viewport. A LOT of engineering devoted to one question: did we click the thing?
The 2012 draft already framed element interaction as "Do what I mean." But here's what gets me: "what I mean" was defined entirely in spatial terms. The element the user pointed at. The center of the bounding rectangle. The thing that's actually visible on screen. Intention, in this spec, is a coordinate problem. Nobody asked whether the resulting action was authorized, whether it should count. Why would they? That wasn't the bug they were fixing.
Playwright pushed further. Its actionability checks gate every interaction behind preconditions: is the element visible? Stable in the DOM? Enabled? Not obscured? Able to receive events? Each check made delivery more precise, more trustworthy, harder to fool. Each check also stayed on exactly the same side of exactly the same line. Whether the click would land. Never whether it was enough.
For a long time, that was fine. A person was always sitting behind the browser. People carry their own accountability. They have reasons for clicking. They can be asked why. They can dispute charges, contest outcomes, explain themselves. The institutional layer lived in the human, not the protocol.
The security section of the 2018 Recommendation addresses whether the user agent enables WebDriver at all, loopback exposure, visual distinction of automated sessions. Mechanical concerns. Whether a resulting server-side action is institutionally legitimate? Not in scope. Not because anyone was negligent. Because the human was there, filling a role the spec never had to name.
"The click was delivered" and "the click should count" are different claims.
For twenty years, a person bridged that gap, and the spec never had to notice.
That silence is getting loud.