Separate the action.
Challenge the outcome.

The existing agent receives the user’s prompt. ANL sits beneath it, not in its place. The gateway resolves a scoped business operation, not an unrestricted UI instruction.

In an authorized, disposable test environment, the worker encodes permitted DOM and ARIA structure into a typed observation IR. Windows UIA is a future direction, not finished native support.

Bounded experiments induce candidate capabilities from partial, observable business transitions. These are causal hypotheses, not universal decompilation or access to hidden internals.

Describe typed inputs, permission policy, preconditions, expected effects, forbidden effects and evidence requirements. Every claim must be narrow enough to challenge.

Challenge wrong targets, stale observations, false success toasts and forbidden side effects. An independently implemented verifier evaluates the contract rather than trusting the action pathway.

A scoped capability certificate records qualification and its limitations. Human activation is separate and explicit. Qualified does not automatically mean active.

Expose only explicitly activated and currently qualified capabilities as typed SDK / HTTP operations and, optionally, MCP tools. Certification is a capability state, not a promise about every future invocation.

The server coordinates an approved intent. The customer-side worker independently enforces local authorization and performs bounded UI actions. No unapproved exploratory production writes.

Fresh authorized observations are checked for expected and forbidden effects. Return VERIFIED, FAILED or UNKNOWN with evidence tiers and limitations. UI readback alone is not an external backend authority.

Changed interfaces, policies or failed qualification can suspend a capability. Recertification and explicit activation restore eligibility; stale certificates must not permit production execution.