MANDATE / RESEARCH
Inside the decision.
Engineering notes on browser evidence, request integrity, and the choices behind a protected action.
Featured / Engineering
Architecture
Why browser proof needs server state
A credential can be well formed and still be the wrong evidence for the next request. Freshness and replay are questions about state.
Read the noteENGINEERING NOTES
More from the team.
Operations
Observe before enforce
A proposed security decision is not an enforced decision. A careful rollout measures the action people are trying to complete.
Read more
Request integrity
Retries, replay, and business outcomes
Rejecting reused proof and preventing a duplicate order solve different problems. A reliable action needs both boundaries to be clear.
Read more