Roll out the browser extension

The browser extension inspects prompts and uploads inside a managed browser before they leave the machine, and it keeps working when the device is off the corporate network. A managed rollout force-installs it and hands it its gateway and key, so nobody signs in and nobody can remove it.

The whole managed surface is four keys: the gateway host, the API key, the fail posture, and optionally an update-channel URL. Everything else the extension does — which filters apply, which thresholds, which sites — is pulled from the appliance at run time and is not configured per device.

Generate the managed policy

The result has two halves: a force-install entry naming the extension id and its update manifest, and a third-party managed-storage block carrying the gateway host, the key and the fail posture.

{
  "ExtensionInstallForcelist": [
    "<extension-id>;https://<crx-host>/extensions/stable/extension-update.xml"
  ],
  "3rdparty": {
    "extensions": {
      "<extension-id>": {
        "cidHost": "https://<appliance-fqdn>",
        "cidApiKey": "cid_key_0123…",
        "failClosed": true
      }
    }
  }
}

Push it to managed browsers

Also set the installation mode to force-installed and block removal, so the extension is a control rather than a suggestion. On an unmanaged device you can enforce none of this — scope the promise to company-managed browsers.

Different policies for different departments

One managed-policy object carries one key, and one key resolves to one tenant. A device that tries to enrol into a second tenant is refused.

Where Finance needs a stricter policy than Marketing, push one policy object per directory group, each with its own key. This needs no product change and uses tenant groups exactly as designed, so the base-and-override filter model from the dashboard applies unchanged.

Enable the firewall block list

Device attestation lets a firewall you already run enforce the rule that AI is reachable only from a device that is genuinely running the extension. CID222 blocks nothing here; the firewall does.

curl -X POST https://<appliance-fqdn>/admin/edl-tokens \
  -H "Authorization: Bearer <admin-jwt>" \
  -H 'Content-Type: application/json' \
  -d '{"name":"perimeter-firewall","expires_at":"2027-01-01T00:00:00Z"}'

Keep it updated

Managed browsers pull new versions from the update manifest named in the force-install entry. A release reaches every enrolled browser within a few hours; a user who wants it immediately can trigger an update check from the browser's own extensions page.

Loading an unpacked folder by hand is a demo and development path only. It receives no updates.

Verify

1. On a pilot device, open the browser's policy page and confirm the extension is listed as installed by policy and that the third-party values arrived.

2. Type a message containing test personal data into one of the covered AI sites. The values are masked before the request leaves the browser.

3. Open All Detections, set Source to Extension events, and confirm the row with its verdict and the site it came from.

4. Open AI Usage and confirm clean traffic is also being reported, which is what proves the extension is inspecting everything rather than only what it stopped.

5. Confirm the device enrolled. There is no device screen yet, so read the inventory from the API:

   curl -s https://<appliance-fqdn>/admin/extension-devices \
     -H "Authorization: Bearer <admin-jwt>"

   The row carries the platform, the extension version, the last-seen time, the observed address and whether enterprise policy provisioned the connection.

6. Revoke that device through the same admin surface and confirm it drops out of the firewall list on the next poll.

If it fails

• The extension is installed but shows as unmanaged — the third-party managed-storage block did not arrive, only the force-install entry. Both halves must be in the same policy object.
• The panel reports invalid credentials and the user cannot fix it — the gateway host in managed policy is wrong, or the key does not belong to that gateway. Managed policy overrides the local value, so the user genuinely cannot correct it.
• AI sites stop working during an appliance outage — the fail-closed flag is doing its job. Decide the posture, do not toggle it in an incident.
• A device never appears in the inventory — enrolment did not complete. Confirm the API host is reachable from the device, and that the key is valid and not expired.
• A revoked device keeps working — revocation removes it from the firewall list, it does not stop the extension. Revocation is deliberately sticky across re-enrolment, so a revoked device cannot re-add itself.
• Uploads of PDF, DOCX or CSV files are refused rather than cleaned — document redaction in place is not implemented. Image redaction works.
• A large or resumable upload is refused with a not-inspected notice — no path reassembles a body across requests, so such uploads are blocked rather than passed through uninspected.

Known gaps

• Coverage is per browser, not per device. A machine whose Chrome is healthy can use Firefox with no extension and the same address stays in the firewall list. Closing this needs the endpoint agent.
• A device id is one browser profile. Two profiles on one laptop are two devices sharing one address.
• An address is not a device. Network address translation, virtual private network concentrators, address-lease churn and shared terminals all break address-as-identity. This control is workable on a well-run corporate network and leaky elsewhere.
• Events are client-reported. The tenant comes from the credential, but the verdict, the hostname and the user attribution are whatever the extension sent. The attestation heartbeat is the cryptographically strong part; the event feed is telemetry, not an audit trail.
• There is no fleet screen. The appliance stores every device's posture, version and last-seen time, and serves the policy each one pulls, but the dashboard has no page that lists them. Read the inventory from the admin API until one ships.
• Sites change their wire format. A vendor that moves its prompt-submit endpoint silently breaks the adapter that recognises it, and requests pass uninspected until the rule is updated.

Next steps

• Browser Extension — the dashboard page: generating the policy, device inventory and revocation.
• Endpoint agent — coverage for desktop applications and command-line tools, which no extension can reach.
• Attribute traffic to directory users — naming the person behind an event when the browser cannot supply an identity.