01
Filling is not submitting
Writing a suggested answer into an input is reversible. Submitting a legal application record is not. Treating both as one capability makes the convenient path the dangerous one.
02
Hash the moment
Before approval, the extension redacts sensitive values, captures the form shape and the submit target, and creates a SHA-256 binding. The resulting grant is short-lived and single-use.
03
Verify again
Right before submission the extension re-inspects and re-hashes the page. A changed field, a navigation or an ambiguous confirmation invalidates the grant instead of guessing.