MANDATE / RESEARCH

Inside the decision.

Engineering notes on browser verification, request integrity, and the choices behind a protected action.

Notes from building browser-action protection.

FEATURED / ARCHITECTURE

A credential can be well formed and still be the wrong evidence for the next request. Freshness and replay are questions about state.

Read the note

More engineering notes

September 2026

OPERATIONS

Observe before enforce

A proposed security decision is not an enforced decision. A careful rollout measures the action people are trying to complete.

REQUEST INTEGRITY

Retries, replay, and business outcomes

Rejecting reused proof and preventing a duplicate order solve different problems. A reliable action needs both boundaries to be clear.