Document the platform category and correct control's sensitivity - #474
Draft
archandatta wants to merge 1 commit into
Draft
Document the platform category and correct control's sensitivity#474archandatta wants to merge 1 commit into
archandatta wants to merge 1 commit into
Conversation
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
`control` used to be every in-VM API call, and the sensitivity table described the whole default set as session metadata with no page content. Both are about to stop being true: `control` narrows to actions that drive the browser and gains the submitted Playwright source on `api_call`, VM-management calls move to a new opt-in `platform` category, and browser-control commands sent over the CDP proxy arrive as `cdp_command`. The sensitivity table now calls out that a default-on category carries submitted source, with the practical advice that follows from it: pass credentials through variables rather than as literals in the snippet. Callers under a BAA get the same note, since `control` stays available to them when the browser-activity categories don't. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
archandatta
force-pushed
the
archand/kernel-1870/telemetry-control-platform-docs
branch
from
August 4, 2026 13:22
21c25ec to
778a23a
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Risk assessment: Very Low
Verdict: Approve
Evidence (from diff)
- 1 file changed:
browsers/telemetry/categories.mdx(+15 / −5) - Documentation-only MDX update on a Mintlify docs site: revises the
controlcategory description, documents a newplatformcategory, and corrects the data-sensitivity table / guidance around Playwrightcodecapture and CDP command redaction - No application logic, APIs, auth, infra, config, or schema changes
- No CODEOWNERS file present; no prior approvals to re-evaluate
Risk factors
| Factor | Assessment |
|---|---|
| Codepaths modified | Docs content only |
| Blast radius | Readers of telemetry category docs |
| Complexity | Low — prose/table updates |
| Infrastructure impact | None |
| Operational / security risk | None in code; content clarifies sensitivity semantics |
Decision
Meets Very Low criteria (documentation-only, small scoped diff, no production logic or shared-system changes). Approving.
Sent by Cursor Automation: Assign PR reviewers
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Docs half of the browser-telemetry
control/platformsplit (kernel-images#322, kernel-images#323, kernel#3086). Two things on this page stop being true when that ships, one of them in a way that matters for compliance.controlnarrows. It was "computer-control API calls against the session" and in practice every in-VM API endpoint. It is now the actions that drive the browser — computer controls, Playwright execution, screenshots, clipboard — pluscdp_commandfor browser-control commands sent over the CDP proxy.platformis new, opt-in, and carries the VM-management traffic that used to sit incontrol(recording lifecycle, filesystem, process, telemetry and browser configuration). Documented with when you'd actually want it: debugging a profile save or a replay rather than the agent.codelanded. It groupedcontrolwith the categories that carry "session metadata only ... no page content", andapi_callnow carries the source submitted for Playwright execution — in a category that is on by default. The row now says so, notes the 8 KB clip, and states whatcdp_commanddeliberately does not capture (typed text, key names, navigation URLs — only the character count).controlstays available to BAA orgs whennetwork/console/screenshotdon't.The default-set description on the overview page is unchanged and still correct — the default set is still
control,connection,system,captcha.Sequencing
Should merge with or just after the kernel-images release and kernel#3086, not before: until then
platformisn't selectable andcontrolstill carries the platform traffic.Notes
Left formatting alone — this file doesn't currently satisfy prettier at baseline and CI only checks broken links, so running it would bury the change in reflowed tables. No new links added.