Your agent fills checkout and sign-in forms with mock tokens. Real card numbers and passwords are substituted inside a secure enclave it can never see.