Back to Policy Packs
Browser Access Policy
Pre-action governance for browser automation and web interactions. Enforces URL allowlists, blocked domains, action restrictions (click, type, navigate), screenshot limits, and interaction patterns to prevent unauthorized web activity and data exfiltration.
v1.0.0
Requirements
Required Capabilities
web.browser
Minimum Assurance Level
L0
Required Limits
allowed_domains
Enforcement Rules
These rules are automatically enforced when using this policy pack
domain_allowlist_enforced
blocked_domains_enforced
action_restrictions_enforced
screenshot_rate_enforced
form_submission_enforced
Best Practices
- Use domain allowlists to restrict browser navigation to trusted sites only
- Block known phishing, malware, and data exfiltration domains
- Restrict browser actions (e.g., block form submissions for read-only agents)
- Limit screenshot frequency to prevent excessive data capture
- Monitor for suspicious patterns (e.g., automated form filling to many sites)
- Log all browser actions with URLs and selectors for audit trail
- Consider blocking authentication-related actions (login forms, password fields)
- Block navigation to private IP ranges and localhost
- Subscribe to status webhooks for instant suspend on suspicious activity
- Use action-specific limits (e.g., max screenshots per hour, max navigations)
- Audit logs should capture action type, URL, selector, and timestamp