Kernel Auth

use a managed auth connection to acquire a reusable authenticated browser profile, or a vault credential to sign in from the agent's own browser, then continue the original website task with the browser-control method that fits it. this skill owns authentication and the handoff to an authenticated browser; it does not assume the task is qa.

decide whether authentication is needed

make this decision before listing or creating managed-auth connections or vault credentials:

1. treat a url as a resource identifier, not as evidence that the task requires browser access.
2. for structured reads and writes, prefer authoritative local records or a dedicated, service-specific api, cli, mcp server, or other first-party integration when it supports the operation. search the host's tool catalog, including deferred mcp tools, before concluding that no integration is available.
3. choose a browser only when the task genuinely requires the authenticated website ui, the dedicated integration lacks the needed capability, or browser behavior itself is under test.
4. after choosing a browser, start hosted login only when the target operation requires authenticated state. public or unauthenticated pages should not trigger managed auth.

if a dedicated integration can complete the task, use it and do not continue with this skill. if the decision selects an authenticated browser path, choose managed auth or vault credentials below; authenticated browser tasks must still use one of them.

choose managed auth or vault credentials