Solace Browser
Trust
What the credential boundary means today, and which part of it is enforced by running code versus still a plan. No aspiration is described here as if it already shipped.
The credential boundary
What holds today
The identity-status interface reports whether a site's identity cookie is present, never its value. This interface does not create per-worker session isolation — see the card beside it for what that means today.
What is not enforced yet
There is no per-worker session partition, no grant with an expiry, and no revoke beyond an ordinary logout. Two workers on the same machine share the same session store today.
Action control
Not built today
Declared preconditions, postconditions and a reversibility class for a consequential action — the check every send, pay, delete or post should carry — do not exist in code yet. The working site recipes are hand-authored data, not audited contracts.
Desktop control
Local consent covers specific desktop capabilities, such as clipboard, windows and launching applications. It does not provide approval checks for every website action.
Web automation limits
The debugging interface is a developer surface, not a fully governed worker interface. Optional restrictions on sites and executable programs are off by default and cover only part of debugging access. Per-action authorization is not enforced across all browser actions.
Evidence
Reconstructing "what did this do in my account last Tuesday" from evidence alone is not possible today — there is no evidence-bundle system yet. Treat every action as unaudited until that ships.