Implement managed browser security, individual agents and observability

docs/website-categories.md

@@ -0,0 +1,34 @@
+# Manage website categories
+
+Open **User classes & website access** in the administrator console. Under
+**Website categories**, add a category and enter:
+
+- A stable identifier, such as `social-sites`.
+- A display name for administrators.
+- One hostname per line, such as `social.example` or `*.social.example`.
+
+Enter hosts without a scheme, path or port. Wildcards cover subdomains; they do
+not also include the bare hostname. Up to 100 categories and 500 unique hosts
+per category are accepted by the category schema; effective signed-policy limits
+are also validated by the server before publication.
+
+Edits remain a local draft until **Publish categories and delegation** is selected.
+Deployments requiring independent approval prepare a proposal for another
+administrator instead. After publication, select the category in the relevant
+user profile and explicitly publish that profile assignment.
+
+Published identifiers are read-only because profiles refer to them. To change an
+identifier, create a new category, update the profile assignments, and then remove
+the old category. A referenced category cannot be removed in the editor; its
+referencing profiles are shown next to the removal control. The backend validates
+references independently of the interface.
+
+Refreshing preserves unsaved category and delegation edits and their original
+policy version. If another administrator publishes changes, the server refuses a
+stale publication. Review the current configuration before preparing a new draft.
+**Discard category draft** explicitly reloads the current published configuration.
+Read-only roles cannot edit or publish categories.
+
+Real Electron UI verification covers draft retention, explicit publication,
+refreshed profile choices, stable IDs, reference restrictions, read-only controls
+and responsive layout. Evidence: `artifacts/category-ui-proof.json`.