Agent-readable docs index: /llms.txt. Full docs in one file: /llms-full.txt. Download /docs.zip to grep all markdown files locally.

Browser use supervisor

One action cycle

The browser use supervisor runs an agent in an isolated browser session and checks each proposed action before execution. Read How Halfspan works for API integration and the guardian proxy, which enforce requests at your application's boundary.
  1. The runtime releases a scoped observation and finite action catalog.
  2. The managed executor returns a versioned proposal, clarification, authorization request, or refusal. Only the proposal branch contains candidate actions, a selection, a reported rationale, and expected effects. Other outcomes pause before a permit is issued.
  3. Deterministic checks validate the service, operation, grant, expiry, budget, target, arguments, and state bindings.
  4. When hard checks pass, the guardian evaluates task relevance and returns ALLOW, PAUSE, or TERMINATE.
  5. The gateway binds an ALLOW to a short-lived, single-use permit. It rechecks authority when claiming and executing the permit.
  6. The adapter executes the approved operation, records a receipt, verifies the result, and observes again.
Consumer explanations are untrusted reported evidence. They do not grant authority and are not proof of intent. A guardian approval cannot override a failed hard check.

Exact and bounded authority

Bounded authority approves limits before execution. Exact authority pauses after preparation so the owner can approve an immutable transaction proposal. Clarification does not expand a grant. Neither mode exposes a general account dashboard to the executor.

Pause, revocation, and uncertain outcomes

Explicit refusals, malformed output, provider errors, stale state, or missing authority can pause a task without issuing a permit. A provider refusal never enters JSON repair or automatic retry. The runtime records a typed stop context and only the corresponding recovery action is permitted. Revocation blocks new dispatches and closes the browser; it cannot undo an already dispatched request.
A restart with an unresolved claimed permit fails closed. For hosted operations, authorization and the remote effect are separate transactions. If a response is lost, inspect the order and evidence before creating another task. The supervisor does not automatically redispatch an uncertain external mutation.

Transports

HTTP and MCP operations share the same transaction handler and credential checks. The MCP endpoint is /mcp on each restricted service. Native WebMCP requires browser support and a usable native actuation interface; unavailable support is reported explicitly.
Read Recovery for permitted next steps, the API reference for request and response fields, and the protocol guide for enforcement boundaries.