Skip to main content

Browser Extension: End-User Guide

This page is for end users of the Control Zero browser extension — the people whose ChatGPT, Claude, Gemini, and other browser AI traffic runs through the extension every day. If you are an admin looking to deploy the extension across a fleet, see Browser Extension Deployment instead.

What the extension does​

The extension watches the AI sites you visit and enforces the DLP rules your organization has set. It can:

  • Alert — show a banner and let you continue.
  • Deny — a configured mask rule prevents the message from being sent.
  • Block — prevent the message from being sent.

Everything runs locally in the browser. Message contents never leave the page unless a rule explicitly captures them.

The badge​

The extension adds a small badge to the toolbar. The color tells you the current state:

  • Green — the extension is active and healthy.
  • Yellow — paused or degraded (policy stale, waiting to sync).
  • Red — blocked state. Something is wrong; click for details.

Click the badge to open the popup.

The popup is your day-to-day interface:

  • Status — current state, last policy sync, which org you are enrolled into.
  • Pause for 10 minutes — temporarily suspend scanning. Useful for quick testing. After 10 minutes the extension snaps back on by itself. Your admin decides whether this button works at all: pause is disabled unless the org has turned it on. The 10 minutes is fixed and cannot be extended, though nothing stops you starting another pause once one expires -- every pause is recorded.
  • Recent activity — the last few rule events (what fired, what action was taken). Click an entry to see details.
  • Help / report issue — opens a pre-filled mail or form to your admin.

What you see when a rule fires​

Depending on the action configured by your admin:

Alert​

A dismissible banner appears at the top of the AI site with a short message explaining which rule fired. You can continue sending the message. The event is logged.

Mask rules​

A mask rule redacts rather than denies on this surface. On a paste, the paste is cancelled and the redacted text is inserted instead -- each match replaced with [REDACTED:<category>:<length>] -- and a toast reads "Paste masked by DLP rule". You can also redact from the finding card, or choose Redact all & send at the send gate.

(On the coding-agent surfaces that cannot accept rewritten tool input -- Cursor, Kiro, Codex CLI, Antigravity -- a mask rule becomes a denial instead. That is a different surface, not this one.)

Block​

A modal stops the submit and explains which rule blocked the message. Where your org leaves the override enabled, it also offers Send anyway -- which requires a typed justification and writes an audit row -- and Redact all & send. If you take neither, the message is not sent.

Keyboard shortcut​

Escape dismisses the current finding tooltip.

The extension registers no other keyboard shortcuts: opening the popup and starting a pause are both done by clicking in the popup itself.

Privacy​

  • The extension only operates on the domains your admin enrolled it for. It does not read arbitrary pages.
  • Captured events are signed and sent to the governance backend your admin chose. The content that leaves the browser is controlled by the rule action: alerts send a short event summary; mask rules are recorded as denials and send only the rule ID and decision.

Troubleshooting​

  • Badge stays yellow. Policy sync is failing. Click the badge and hit Sync now. If it keeps failing, your enrollment may have been revoked. Contact your admin.
  • Badge is red on a site you use daily. The site is on your org's blocked list. Ask your admin.
  • Popup says "not enrolled". Your extension was installed without an enrollment key. Your admin can redeploy with the right key from the browser-extension deployment page.