How Halfspan works

Halfspan puts a permission check in front of configured website or API operations. The company keeps its application, accounts, and business logic. Halfspan checks a proposed action, issues permission when the checks pass, and records dispatch and outcome evidence.

The browser use supervisor controls the browser session it starts. The guardian proxy works with browsers running elsewhere; it controls network requests to your application, not the browser itself. API access decisions use programmed rules, while browser guardian review can also evaluate the proposed action with a model.

For a configured purchase endpoint, the guardian proxy checks requests from supervised sessions before they reach your application. This flow assumes enforcement is enabled. Public read exceptions and the guardian API have separate handling.

The current browser proxy treats a verified AI-assistant signal, a bot score of exactly 1, or a valid guardian session bound to the configured application credentials as supervised traffic. Other traffic is classified as unknown and follows the ordinary application path. Unknown does not mean human.

API traffic policies can also use score bands, User-Agent claims, and reviewed IP ranges from a trusted detection adapter. Those signals do not expand the proxy's classification rules above. Provider names and IP matches do not grant identity or permission, and detection cannot identify every browser bot.

For supervised pages, Halfspan advertises same-origin agent instructions through discovery links. A compatible agent or browser adapter reads the site's configured actions and sends a structural observation and a proposed action through the protocol. The observation omits input values; action arguments and protected requests can still carry customer data. The browser discovery guide explains the protocol's role and the staging passkey approval flow.

This interface helps cooperating agents request approval. A client controlling its own browser can issue a request directly. The proxy checks configured protected requests on the server, and Halfspan cannot prevent the browser from reading content already delivered to it.

The agent submits an action, its arguments, a reference to the current observation, its explanation, and expected effects. The server checks the configured operation, input bounds, target, observation, and declared effects. When those checks pass, the guardian model reviews the proposal against policy and recorded execution history.

The model can allow, pause, or terminate. An explanation is untrusted input, and a model's approval cannot override a failed programmed check. Browser observations are client-reported; matching an action to that observation does not prove the observation is true. Company facts such as ownership, current prices, and available funds require authoritative application checks.

After review, the server checks current state again. Only server code can create and sign a permit. A browser-network permit binds the session, policy revision, observation, selected action, request method, public origin, path, exact body hash, content type, and configured login context. It lasts at most ten seconds. Local-action permits last at most thirty seconds.

A permit for POST /purchase with {"quantity":1} does not authorize a body containing {"quantity":10}. The signature prevents forging a permit; the database enforces expiry, revocation, current state, and single use. A new separately approved permit is a new authorization: single use does not impose a lifetime purchase limit.

The proxy checks the permit independently of the page. A supervised purchase without a valid permit receives HTTP 403 before reaching the company's purchase handler. Changing the request or reusing its permit also fails.

The company's server must reject direct access around the proxy, and every alternate route to the same protected effect needs equivalent checks. Restricting the origin does not fix the unknown-traffic bypass: that traffic already passes through the authorized proxy.

The company application performs the operation. Halfspan consumes authorization and records dispatch before forwarding. It does not automatically redispatch an uncertain write.

The proxy records the HTTP status and a response-body hash. A response, including an error response, is not proof of whether the business transaction committed. The company needs durable transaction deduplication and business receipts or reconciliation. Exact request bytes alone do not freeze a changing cart, price, or account balance.

The company supplies trusted identity, consent, request-integrity checks, and resource authorization. An agent cannot declare itself authorized in its request body. The decision engine can require authentication, consent, missing inputs, or acceptance of a narrower permitted request. Exact permits last at most thirty seconds; explicitly configured bounded read grants have separate duration and use limits.

Humans retain their company authentication flow. All integrated operations still undergo company authorization and configured rules; authenticated agent operations additionally require agent permits. Optional traffic rules can allow, challenge, require enrollment, or deny, without creating account permissions. Challenge-required responses exist, but challenge provisioning and completion need a real integration.

The current adapter filters explicitly allowed top-level output fields. Allowing an entire nested object does not filter its children. The managed browser proxy does not provide this response-field filtering.

Discovery and MCP make the supported route available to an integrated agent. They do not make arbitrary agents automatically understand Halfspan's protocol or compel a bot to cooperate.

Rules that must hold for every caller must run on the server regardless of automation classification. Explicit agent identities can receive separate delegated permissions; bot detection alone cannot guarantee different treatment for an agent using a person's ordinary browser and credentials.

Your application can remain on its existing hosting provider. Choose an integration that can authenticate requests and enforce permissions at the relevant routes. Confirm your ingress compatibility and required detector signals during Company setup.

The guardian proxy processes decrypted HTTP traffic. Structural browser observations omit input values, while action arguments and protected requests can still contain them. Read Data access and privacy to decide which fields to expose for supervision. The agent quickstart covers connecting an executor to the browser use supervisor.