Company setup

Choose the operation you want an agent to perform, identify the application routes that execute it, and decide which account permissions and business limits apply. Creating a service record or guardian draft does not install enforcement; you must connect the relevant request paths.

Start with one operation in staging, using your application's authentication and test records. Verify both an authorized request and a rejected request before expanding coverage.

You can keep your application on its existing hosting provider. API and gateway integration do not require Cloudflare. For a proxy integration, confirm the supported ingress adapter and available detection signals before routing traffic. Obtain the integration package, service address, and server credential from your integration operator.

Use a company owner/admin account to register the service and review its contract. The API importer accepts a limited OpenAPI 3 JSON subset. Parameterized paths, nested input schemas, external references, streaming, and WebSockets currently need explicit treatment; they are not silently supported.

Map the real method and path to an operation and define its inputs, permissions, consent requirements, limits, and allowed output fields. Imported operations start denied. For browser supervision, also map the page controls to those operations and identify allowed passive reads. A company must confirm the business meaning of the mapping.

For the API integration, supply trusted company authentication, request-integrity checks, resource ownership checks, permissions, and consent. Agent identity must come from authenticated company state, not a body field or User-Agent claim.

For the guardian proxy, select the application's actual login cookies or an explicit bearer-only identity source. Empty or ambiguous credentials cannot establish a supervised identity. This binds continuity to credentials; it does not create a stable account-wide budget or ban across credential rotation.

Backend integration replaces the selected route registrations with guarded handlers. Do not keep an unguarded equivalent mounted elsewhere.

A gateway or browser proxy must be on the relevant request path, and the origin must reject direct access around it. Check alternate endpoints and deployments that can trigger the same effect. The application continues to authorize the account and resource when a request reaches it.

For writes, deduplicate a stable operation key in the same durable transaction as the business effect. Add authoritative checks for quotes, versions, amounts, recipients, and cumulative limits where the workflow requires them. A matching HTTP request alone does not supply those guarantees.

Confirm what page fields, arguments, identity information, model inputs, and evidence may be processed and retained. The guardian proxy can see decrypted traffic, and action arguments or protected requests can carry customer data. If those values must stay inside your infrastructure, confirm a compatible data boundary before integration. Data access and privacy describes what leaves the application and what you need to review.

Choose per-operation behavior for ordinary traffic, authenticated agents, suspected automation, unavailable detection, and public search crawlers. Start classification changes in observation mode and compare proposed decisions with labeled traffic.

The classifier needs trusted ingress signals. IP lists and User-Agent names do not create an authenticated agent identity. If using challenges, connect a challenge and server-side completion verifier; a challenge-required response alone does not provide one. Point the enrollment response to your supported agent integration.

For the API path, configure the agent to use discovery, company authentication, interactions, access requests, and permitted execution through HTTP or MCP. For browser supervision, connect the agent to the proposal interface and test the browser adapter against your workflow. Discovery does not automatically make an agent compatible with the protocol.

The browser v2 guardian proxy can advertise website agent instructions through page links and blocked-request responses. These explain how a visiting agent supplies its task goal, attaches a session, and submits each proposed action with a brief justification. Envoy serves the instruction paths through the runtime on your domain.

Approve the saved contract or policy revision. The operator runs trusted deployment checks for identity, authorization, request matching, permit reuse, alternate routes, origin restrictions, and normal-user compatibility. Domain ownership verification is not proof of enforcement.

Activation is gated on verification of that revision. Changing the contract or deployment requires the appropriate fresh verification. Test missing credentials, changed arguments, direct requests, uncertain outcomes, and rollback before enabling enforcement on real operations.

Keep a record of the operations, routes, identities, and policy revision covered by your integration. Ask your integration operator for the corresponding verification results and agree who handles alerts, retention, revocation, and uncertain transactions.

The guardian proxy allows unknown traffic through without guardian permits. Enforce business limits required for every caller separately from automation detection. Read How Halfspan works for the request flow and enforcement boundaries.