01
Filling is not submitting
Writing a suggested answer into an input is reversible. Submitting a legal application record is not. Treating both actions as one capability makes the convenient path the dangerous path.
02
Hash the moment
Before approval, the extension redacts sensitive values, captures the form shape and target, and creates a SHA-256 binding. The resulting grant is short-lived and single-use.
03
Verify again
Immediately before submission, the extension checks the current target and form state. A changed field, navigation event, or ambiguous confirmation invalidates the grant rather than guessing.