Implement managed browser security, individual agents and observability

docs/ai-browser-control.md

@@ -0,0 +1,41 @@
+# AI browser control
+
+Central `agents.enabled` controls the entire local interface. Actions also require
+individual policy scopes and approved destinations; changes and expiry are checked
+again around asynchronous work. Revocation aborts active requests and stops access.
+
+Implemented application controls: list sessions, open/activate/close/group tabs,
+navigate, read approved visible content, inspect non-sensitive form values and
+selectors, scroll, click, type, use the approved AI gateway, read/change permitted
+appearance settings, organize personal bookmarks, and propose/apply AI library
+organization when separately enabled. Company bookmarks and locked settings retain
+their central restrictions. `inspect` and `scroll` are opt-in scopes.
+
+Use the trusted local Electron helper with an absolute DPAPI pairing file and a
+JSON action file:
+
+```powershell
+npx electron scripts/agent-client.cjs --connection C:/path/agent-connection.json --request C:/path/action.json
+```
+
+Example action:
+
+```json
+{"action":"inspect","args":{"sessionId":"managed-session-id"}}
+```
+
+The helper unwraps the pairing capability through Windows DPAPI. The local channel
+uses pinned Ed25519 and ML-DSA-87 identities, ML-KEM-1024 key establishment and
+AES-256-GCM request/reply protection, with one-use challenges and HMAC-SHA384 proofs bound to the exact body, route, timestamp and nonce. The capability token is never sent on the wire. Plaintext action
+requests and successful plaintext replies are rejected. Never copy pairing secrets
+into chat, source files or ordinary logs. Restart/revoke requires fresh pairing.
+
+OpenTelemetry measures authorization, audit, action dispatch, result projection and
+encryption separately in debug mode. Durable security events remain distinct from
+operational traces. Administrators independently control diagnostics and SIEM
+export; ECS/CEF forwarding can be stopped centrally without deleting queued audit.
+
+This remains under heavy development. A shared local capability is not yet a full
+per-agent identity/consent system. History, safe screenshots, frame-aware controls,
+select menus and other richer interactions need additional typed actions and tests.
+Arbitrary JavaScript, cookies and secret extraction are not control APIs.