Action supervision with minimized, redacted local records.

1. Scope and single purpose

Agent Guard supervises browser-visible activity performed by AI agents on websites a user explicitly authorizes. It identifies supported high-risk actions and sensitive-data categories, compares actions with user-confirmed intent and deterministic policy, requests approval or blocks supported actions, and keeps a redacted local audit trail.

Agent Guard is not a general chatbot, password manager, tracker blocker, endpoint DLP system, or guarantee against every prompt-injection attack.

2. Information processed

On authorized sites, Agent Guard may transiently process browser-visible field values or metadata to classify personally identifiable information, health information, financial or payment information, authentication information, precise-location fields, and other sensitive categories.

It may inspect bounded page text on authorized webmail, messaging, collaboration, or other pages for prompt-injection signals. It may also process authorized site origin, redacted URL, timestamps, browser-visible clicks, input attempts, submissions, sends, uploads, downloads, navigation, approvals, settings, field labels, target descriptions, links, and destination origins.

Agent Guard does not intentionally perform keystroke logging or retain typed text as a transcript.

3. Data minimization

Raw form values and bounded page text are inspected transiently in the page and are not intentionally stored in the audit model. Persistent records use sensitive-data category indicators, redacted labels, redacted URLs, origin names, amount buckets, action metadata, policy decisions, and other minimized context.

A page-local masked preview can be shown during approval but is not sent to the extension service worker or included in exports. Agent Guard does not intentionally read or retain file contents, Cookie values, browser-storage values, full request bodies, or private keys.

4. How information is used

Information is used only to show Guard Health and session status; evaluate intent contracts, risk budgets, profiles, and local policy; pause, approve, block, or replay supported actions; build local data-lineage and prompt-risk associations; compare local sessions; generate user-requested exports; link optional cross-tab workflows; and install optional temporary network-quarantine rules.

Policy decisions are deterministic in the current release. Agent Guard does not send prompts or page content to a developer-operated AI service.

5. Local storage and retention

Live sessions are stored in chrome.storage.session. Settings, user rules, imported policy, and optional bounded history are stored in chrome.storage.local. Administrator policy may be read from chrome.storage.managed.

Users can disable history, set available retention limits, clear local data, remove rules, revoke grants, and uninstall the extension.

6. Transmission, sale, and sharing

Agent Guard 1.0.1 includes no developer-operated analytics, telemetry endpoint, cloud account, remote AI service, or remote executable rule feed. It does not transmit audit reports, browsing activity, form values, policy settings, or local history to the developer or third parties.

Agent Guard does not sell user data and does not use data for advertising, creditworthiness, or lending. A user may deliberately export a report to their own device and then choose to share it.

7. Permissions and authorized-site access

Default API permissions are activeTab, scripting, sidePanel, and storage. HTTP and HTTPS site access is optional and requested per origin only after the user chooses to authorize that site.

Optional permissions may include notifications for a generic approval notice, webNavigation for local cross-tab workflow linkage and document lifecycle, and declarativeNetRequestWithHostAccess for temporary tab-scoped destination quarantine without reading request bodies. Users can revoke site access and optional permissions.

8. Security and limitations

Agent Guard uses bounded messages and collections, sender and document binding, redaction, export sanitization, packaged executable code, and explicit coverage reporting.

No software can identify every agent, detect every prompt injection, observe server-to-server processing, stop synchronous channels that cannot wait for approval, or guarantee complete security. Page-derived evidence is untrusted and can be influenced by the website.

9. User choices, contact, and changes

Users may revoke site access and optional permissions, disable Deep Probe and local history, clear history or all extension data, remove rules, reject actions, use Panic Lock, uninstall the extension, and delete exported files.

Privacy questions can be sent to [email protected] or [email protected]. Material changes will be reflected in this policy before or when the new processing becomes available.