The Browser Is the Policy Enforcement Point. The Network Never Sees the Session
The thesis would be wrong if independent measurements showed that credential theft, sensitive-data movement, and SaaS authorization still happen mostly outside the browser session, and that adding browser-layer controls does not catch incidents…