# Task execution rules

> Palladin documentation · 1.0 · EN · 2026-10-25


Browser Inject currently works only on macOS through the Palladin extension. Linux CLI support does not include Inject.

## Choose a method

| Need | Method | What reaches the model |
| --- | --- | --- |
| A program needs a credential | `exec_with_credential` / `exec` | Status; a Script result only under its explicit policy. |
| A login form needs a credential | `inject_credential` / `inject` | Operation outcome without field values. |
| The task requires intentional reading | `get_credential` / `get` | Permitted plaintext; deliberate disclosure. |

Prefer Exec or Inject. Never fall back to Get after denial, provider unavailability, or a permission issue.

## Discovery and approval

Search only the metadata needed for the task. Use the correct `profile`, exact IDs, and a specific reason. Request minimal scope. Do not change the method or target while waiting for approval. Time and usage limits do not authorize a different task.

## Browser

Prepare the visible form and clear obstacles such as a consent dialog according to the user's decision. Select the exact current tab and URL. Do not read fields after injection. Never route a password through your own JavaScript, clipboard, or typing tools.

An unavailable provider ends this path. Do not bypass host, document, artifact-signature, or consent checks.

## Errors and results

Never save secrets, parameters, script source, or program output to task memory. A Script result may contain derived data: handle it under the explicitly approved policy. Report a stale credential using a reason code, not its value.