Identra Logo
IDENTRA
CONTROL AGENT ACTIVITY

Control AI agents driving the browser

Your employee signed in. An AI agent is now acting with their access. Identra detects agents driving the browser and can block them by policy.

WORKS INBrowser
See Identra in the browser
Browser AI agentsCOVERED
  1. Block browser agents by policy01
  2. Keep AI use in work accounts02
  3. Protect prompts before they leave03
  4. Control uploads to AI04
  5. Disable risky browser extensions05
ONE IDENTITY · ONE TIMELINEBrowser
01What goes wrong today

The risk is already in use.

What security teams run into with browser AI agents today, before a control is in place.

  • 01

    The session is already open

    A browser agent can operate inside an employee's signed-in session. The access granted to a person becomes access an agent can use.

  • 02

    One request, many actions

    A request to summarize a report can lead an agent through pages, forms, and files. The employee may not review each action along the way.

  • 03

    Company data, personal AI

    An agent can carry work data into a personal AI account. Approving an AI app does not settle which account should receive that data.

  • 04

    An inventory leaves decisions open

    Knowing which AI tools employees use does not decide whether those tools should drive signed-in browsers. Security teams need controls they can enforce.

02What Identra does

What changes with Identra.

Covered by Identra Guard in the browser, tied to one identity and one timeline.

Identra Guard in the browserSee Identra in the browser
  • 01

    Block browser agents by policy

    Identra detects AI agents driving the browser and can block them by policy. Put an enforceable boundary around agent activity in signed-in sessions.

  • 02

    Keep AI use in work accounts

    Allow, redirect to the company AI workspace, or block access by signed-in account for ChatGPT, Gemini, Claude, Perplexity, and Grok. Apply account-aware AI access to the account receiving company work.

  • 03

    Protect prompts before they leave

    Check prompts before send and allow, alert, mask, or block them by policy. Prompt content stays on the device by default.

  • 04

    Control uploads to AI

    Inspect file uploads, including sensitivity labels, and block uploads to AI by policy. Give sensitive files a boundary at the point of sharing.

  • 05

    Disable risky browser extensions

    See installed browser extensions and flag those that read sign-in sessions. Disable risky extensions by policy to reduce exposure around signed-in work.

  • 06

    Bring activity back to identity

    Connect browser activity with endpoint and provider activity in one identity timeline, where the person is known. Review incidents with the person's broader activity in view.

03Before and after

“Summarize this internal report for me.”

The same moment, played twice. Once without Identra, once with it.

WITHOUT IDENTRA

EXPOSED

  1. An employee opens an internal report in a signed-in browser.

  2. They ask a computer-use agent to summarize it using an AI app.

  3. The agent carries report text into a personal AI account without the employee reviewing the transfer.

WITH IDENTRA

CONTAINED

  1. Identra detects the AI agent driving the browser and blocks it under the organization's policy.

  2. The employee opens ChatGPT themselves and is redirected from their personal account to the company AI workspace.

  3. Before the employee sends report text, Identra checks the prompt on the device.

  4. Sensitive content triggers the configured prompt policy, and the send is blocked.

04How it works

Four steps. One timeline.

  1. 01

    See

    Discover AI apps, the accounts people use, installed extensions, and AI agents driving the browser.

  2. 02

    Decide

    Set policies for browser agent blocking, account-aware AI access, sensitive prompts, and file uploads.

  3. 03

    Enforce

    Block browser agents by policy, redirect supported AI access to company workspaces, and protect prompts before send.

  4. 04

    Review

    Review browser activity alongside endpoint and provider activity in one identity timeline, where the person is known.

QUESTIONS

What buyers ask us about browser AI agents.

Does prompt protection send employee prompts elsewhere?

Prompt content stays on the device by default. Prompts are checked on the device before they are sent, and policy determines whether to allow, alert, mask or block.

How is browser protection deployed?

Identra Guard is a browser extension for Chrome, Edge, Firefox and Safari. It provides browser agent detection and policy blocking, account-aware AI access, prompt protection, upload controls, and browser extension controls.

Will employees have to stop using AI?

No. Policies can allow supported AI access or redirect employees to the company AI workspace. Prompt policies can allow, alert, mask sensitive content and send, or block. Browser agent activity can be blocked by policy.

Which AI apps support account-aware access?

Identra supports account-aware allow, redirect, and block controls for ChatGPT, Gemini, Claude, Perplexity, and Grok. These controls let you distinguish work accounts from personal accounts.

How should we scope this alongside desktop agents?

This solution focuses on AI agents driving the browser and the browser's account, prompt, upload, and extension controls. Identra's separate macOS and Windows endpoint agent covers coding agents, desktop AI apps, MCP servers, skills, and plugins. See secure coding agents for that use case.

Can we connect this activity to an employee?

Where the person is known, Identra ties browser, endpoint and provider activity to the person in one timeline and groups related activity into incidents. Reviewers get identity context across those surfaces.

KEEP READING

The terms, comparisons and essays behind this page.

GLOSSARY

COMPARE AND READ

MORE AI PROBLEMS IDENTRA SOLVES

All solutions
SEE IT IN YOUR ENVIRONMENT

See Identra handle browser AI agents.

A walkthrough with a security engineer.

See Identra in the browser