Context Firewall

Agent governance covers the agents a company builds and the tools it wires up. It does not cover an employee with a browser tab open, and that is where most day-to-day AI use actually happens: a support transcript pasted for summarising, a customer list pasted for cleanup, an API key pasted inside a stack trace.

That traffic leaves through an ordinary HTTPS request to a vendor an employee is allowed to use, so a network control sees a permitted destination and a DLP tool built for email and file shares never sees it at all. The content is gone before any of it applies.

The Context Firewall is a browser extension, and it sits between the composer and the send. It reads what is about to leave, applies policy to it, and either masks the protected values or stops the message. What reaches the assistant is the redacted version, because the original never left the tab.

This is the same posture the harness gives a custom agent, reached from the other side. The harness evaluates a tool call before it executes; the firewall evaluates a message before it sends. Both decide in front of the action rather than reporting on it afterwards.

Detection runs locally, in the extension. There is no round trip to a classifier and no second model reading the content in order to protect it, which is the awkward bargain a lot of AI-era DLP asks you to make: the tool that inspects your sensitive data becomes another place your sensitive data goes.

Because the decision is local, it also costs the user nothing they would notice. Typing is not interrupted, the assistant behaves normally, and the only visible difference is that protected values arrive masked.

Every assistant composes and sends differently, so the firewall carries a per-surface adapter rather than one generic rule that half works everywhere. There are five: ChatGPT, Gemini, Microsoft Copilot, Claude and Perplexity. They were picked by measured web-traffic share and cover the overwhelming majority of browser AI-assistant use.

A named adapter is also what makes the coverage claim checkable. An assistant is either adapted or it is not, and the list says which, rather than implying that anything with a text box is handled.

The browser is the first surface, not the only one. The same pre-send posture applies wherever a person or an agent hands context to something outside the company, and MCP is the next seam that matters: an agent reaching a Model Context Protocol server is another path where content leaves before anything in the runtime has an opinion about it.

That work is a gateway rather than an extension, and it is on the roadmap rather than in front of you today. The principle carries over unchanged. Decide in front of the send, decide locally, and leave a record of what was masked and why.