Treat session portability as a dead assumption.

Treat session portability as a dead assumption. Modern providers intentionally tie session state to their browser, device, and anti-abuse context, so trying to export cookies or “hand over” a human session to an agent will be flaky at best and a security hole at worst. Build agents to request narrow, delegated authority (time- and scope-limited tokens) and to support resumable re-auth flows that can recreate context, rather than smuggling a full session off the device. That design keeps your attack surface small and your integrations practical.