A method performed by data processing apparatus, the method comprising: receiving a rendering notification of a rendered element (214, 264) defined in an active window on a client device, wherein the rendering notification comprises a location of the rendered element in the active window; receiving a declaration of the rendered element defined in the active window on the client device, wherein the declaration includes the location of the rendered element in the active window and a declared appearance of the rendered element; detecting interaction with the rendered element at the client device; determining, based on the received declaration, whether the interaction occurred at the declared location of the rendered element within the active window; and processing the interaction based on the determination of whether the interaction occurred at the declared location, including: in response to determining that the interaction occurred at the declared location of the rendered element: capturing a screenshot of the active window on the client device; verifying a visual appearance of the rendered element in the screenshot with the declared appearance of the rendered element; and generating, based on verifying the visual appearance of the rendered element in the screenshot with the declared appearance of the rendered element, an interaction attestation for the interaction with the rendered element, thereby validating the interaction; and in response to determining that the interaction did not occur at the declared location of the rendered element, refraining from generating the interaction attestation for the interaction with the rendered element. receiving a rendering notification of a rendered element (214, 264) defined in an active window on a client device, wherein the rendering notification comprises a location of the rendered element in the active window; receiving a declaration of the rendered element defined in the active window on the client device, wherein the declaration includes the location of the rendered element in the active window and a declared appearance of the rendered element; detecting interaction with the rendered element at the client device; determining, based on the received declaration, whether the interaction occurred at the declared location of the rendered element within the active window; and processing the interaction based on the determination of whether the interaction occurred at the declared location, including: in response to determining that the interaction occurred at the declared location of the rendered element: capturing a screenshot of the active window on the client device; verifying a visual appearance of the rendered element in the screenshot with the declared appearance of the rendered element; and generating, based on verifying the visual appearance of the rendered element in the screenshot with the declared appearance of the rendered element, an interaction attestation for the interaction with the rendered element, thereby validating the interaction; and in response to determining that the interaction did not occur at the declared location of the rendered element, refraining from generating the interaction attestation for the interaction with the rendered element. in response to determining that the interaction occurred at the declared location of the rendered element: capturing a screenshot of the active window on the client device; verifying a visual appearance of the rendered element in the screenshot with the declared appearance of the rendered element; and generating, based on verifying the visual appearance of the rendered element in the screenshot with the declared appearance of the rendered element, an interaction attestation for the interaction with the rendered element, thereby validating the interaction; and capturing a screenshot of the active window on the client device; verifying a visual appearance of the rendered element in the screenshot with the declared appearance of the rendered element; and generating, based on verifying the visual appearance of the rendered element in the screenshot with the declared appearance of the rendered element, an interaction attestation for the interaction with the rendered element, thereby validating the interaction; and in response to determining that the interaction did not occur at the declared location of the rendered element, refraining from generating the interaction attestation for the interaction with the rendered element.