Browser discovery and passkey approval

With the browser v2 guardian proxy enabled, Halfspan adds site-specific agent.json and agent.md discovery links to a supervised HTML response and advertises them in its Link header. The HTML insertion requires a response the proxy can inspect with an explicit <head> before page scripts. The discovery resources are also available at the advertised same-origin URLs. Halfspan does not inject a Guardian panel or an action-intercepting script into the page. Reading a discovery link does not grant authority.

The site advertises its configured actions and published workflows through the same-origin protocol. A compatible agent or browser adapter reads that configuration, attaches the task goal to a verified workflow, sends fresh observations and action proposals, and checks the review status. The website agent instructions describe those commands. Discovery does not make every visiting agent automatically compatible.

After a task is attached, the browser adapter reports the current route template and configured structural controls as an observation. Control records can include approved labels, locators, match counts, and state flags; the observation does not include input values, full page text, URL queries, or fragments. The next action must match a released workflow step and a uniquely matched configured control. The agent supplies a brief justification and waits for the Guardian decision. A changed page requires a fresh observation.

The agent or its compatible browser adapter must use the current observation and approved workflow step, obtain a fresh single-use permit, and attach it to the exact protected request. A review decision alone does not execute an action. The proxy checks protected network requests before forwarding them to the application; a request without a matching permit is rejected when that route is configured for supervision.

The protocol relies on a cooperating agent or adapter to report page observations and use permits. Browser-reported observations are not proof of the page state. Protected effects rely on the proxy's server-side permit check, origin restrictions, and the application's own authorization. Unknown traffic currently follows ordinary application authorization without a guardian permit. See How Halfspan works for the full boundary.

Action arguments and protected request bodies can still contain customer data. Review the capture configuration, request mappings, and Data access and privacy before supervising sensitive controls.

The verified staging transfer workflow can request one advance approval for an exact fictional transfer. The agent or browser adapter presents the returned URL in a separate, top-level Halfspan approval window or tab for the owner or admin. The URL only locates the request; it is not an approval token. The page shows the website, amount, source and destination accounts, fee, expiry, one-transfer limit, and ordered actions. The owner creates a Halfspan passkey if needed, then makes a separate passkey assertion to approve.

The pending request expires after 15 minutes. Successful passkey verification starts a five-minute grant bound to the task, workflow revision, and exact transfer facts. Once approval is recorded, the agent can continue the verified setup actions and final transfer. Each action still needs its own proposal and single-use permit; the final protected request must match the approved terms and receives Guardian request review. A changed task, assignment, action, or transfer requires a new approval.