Deploys through the browser policy you already run.
A Chrome MV3 extension: content scripts on the AI tools, plus a background service worker. Push it with the same management console you use for every other extension, and it's live across the fleet.
What the employee sees
The control only works if the person on the other end of it understands what happened and why. A block explains itself, names the policy, and asks for context the security team can triage.
This prompt contains an Aadhaar number and an AWS access key. Both are blocked by acme.production policy v14.
58 / 20 characters minimum
Redactions are silent — the sensitive span is replaced and the prompt goes through, since interrupting someone for every email address would get the extension uninstalled inside a week. Only warnings and blocks stop to ask, and both record the justification to the audit trail whether or not the person goes ahead.
What deployment actually involves
Short list, on purpose.
Force-install via policy
Chrome Enterprise, Google Workspace, Microsoft Intune, or any MDM that can set browser policy. The extension shows up on managed browsers at their next sync — nothing for anyone to click.
No infrastructure change
No proxy to stand up, no certificate to distribute, no DNS change, no gateway sitting in the request path waiting to become an outage.
Detection stays local
Analysis runs inside the extension itself. There's no network hop in the typing path, because there's no network call to make.
Why not a proxy, a CASB, or a gateway
Each of these is a perfectly reasonable control for the problem it was built to solve. None of them was built to solve this one.
Network proxy / TLS inspection
Anything off the corporate network. Certificate pinning breaks it, and a laptop at home walks straight past it.
Runs in the browser wherever the browser runs — office, home, or a café.
CASB
Only the SaaS apps already in its catalogue. New AI tools show up weekly, and a catalogue is always a step behind.
Works on the page itself, so a tool it's never heard of still gets caught.
API gateway in front of an LLM
Only prompts routed through your own applications. Someone typing straight into chatgpt.com is invisible to it.
Sees the direct web usage that's the real shadow-AI problem.
Endpoint DLP
Built for files and clipboard events. A free-text prompt is neither one.
Reads a prompt as a prompt, with detectors written for conversational text.
The honest tradeoffs
It covers browsers, not everything. A prompt sent from a native desktop app or a terminal never passes through a browser extension. A desktop agent that closes that gap is designed and parked as a later phase — it isn't shipped, and we'd rather tell you that now than have you discover it after deployment.
Chrome and Chromium today. Edge and Brave work too, since they're Chromium under the hood. Firefox and Safari aren't supported yet.
A determined insider can still get data out. Someone set on leaking data can photograph a screen or switch to a personal device. This is a control for the accidental and the careless — the overwhelming majority of real incidents — not a guarantee against someone actively trying to beat it.
Where it runs
Content scripts ship registered for ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, and Open WebUI — the common self-hosted and Ollama front-end. Because it works at the DOM rather than against a catalogue of known API endpoints, an internal or newly-launched tool can be covered just by adding a match pattern.
Next: the policy engine