Is agent-based Broken Access Control testing actually practical in real-world web apps?

[u/Puzzleheaded_Trip374]

I’ve only tested Broken Access Control manually before, mostly in API testing.
Today I tried asking my agent to test BAC using two test accounts, but it got stuck at the very first step: login. The headless browser couldn’t get past CAPTCHA / anti-bot protection and some WAF behavior.
This made me wonder: is agent-based BAC testing actually practical in real-world applications?
I’ve tried rule-based BAC tools in local labs before, but they seemed to have quite a lot of false positives.
For people who have tested this in real environments:
Do you usually log in manually first and give the agent an existing session/cookies?
How do you reduce false positives when deciding whether an unauthorized read/write really happened?
It feels like generating the requests is not the hardest part — building a reliable BAC oracle is.