Context and protected action
The browser submits a sign-in form to an application-owned handler. The protected action is that form submission, not every request associated with the account. Session refresh, identity-provider callbacks, and service clients are inventoried separately.
The desired design keeps the existing authentication outcome authoritative. Browser evidence provides request context; it does not establish that the person owns the credentials or that a real browser has a human operator.
Integration boundary
A supported browser integration carries opaque proof with the protected submission. The server-side integration consults hosted verification and passes control through the application’s established handler. Keep account lookup, credential verification, session creation, and authorization on the server.
Use the matching managed preview instructions from the dashboard and Node reference. Package publication and production activation are separate steps.
Observe plan
- Begin the native Verify workflow in Observe and keep proposed decisions distinct from applied actions.
- Review completed sign-ins, failed credentials, session changes, and recovery journeys separately.
- Use application completion events and support reports alongside grouped verification evidence.
A verification call establishes that the integration ran; it does not establish that the person signed in successfully. An Observe result is not a blocked attempt.
What remains application-owned
Preserve account lockout and recovery behavior deliberately. A recovery flow should not accidentally become subject to browser requirements intended for a different route. Protect tenant boundaries and avoid disclosing whether an account exists through a changed response.
Availability behavior also belongs in the integration plan. A failed verification dependency must remain distinguishable from a successful verification result.
What to validate
- Ordinary sign-in and invalid credentials retain their expected application responses.
- Expired sessions, supported browsers, assistive-technology journeys, and recovery paths are reviewed.
- Pausing the scoped integration preserves authentication and does not widen account access.
This walkthrough describes design and review steps. It reports no customer deployment, measured detection rate, or observed customer outcome.