Context Firewall

Agent governance covers the agents a company builds and the tools it wires up. It does not cover an employee with a browser tab open, and that is where most day-to-day AI use actually happens: a support transcript pasted for summarising, a customer list pasted for cleanup, an API key pasted inside a stack trace.

That traffic leaves through an ordinary HTTPS request to a vendor an employee is allowed to use, so a network control sees a permitted destination and a DLP tool built for email and file shares never sees it at all. The content is gone before any of it applies.

The Context Firewall is a browser extension, and it sits between the composer and the send. It reads what is about to leave, applies policy to it, and either masks the protected values or stops the message. What reaches the assistant is the redacted version, because the original never left the tab.

This is the same posture the harness gives a custom agent, reached from the other side. The harness evaluates a tool call before it executes; the firewall evaluates a message before it sends. Both decide in front of the action rather than reporting on it afterwards.

Detection runs locally, in the extension, with a small on-device detector. There is no round trip to a classifier, and nothing leaves the tab to make the decision, which avoids the awkward bargain a lot of AI-era DLP asks you to make: the tool that inspects your sensitive data becomes another place your sensitive data goes.

Because the decision is local, it also costs the user nothing they would notice. Typing is not interrupted, the assistant behaves normally, and the only visible difference is that protected values arrive masked.

Every assistant composes and sends differently, so the firewall carries a per-surface adapter rather than one generic rule that half works everywhere. There are five: ChatGPT, Gemini, Microsoft Copilot, Claude and Perplexity. They were picked by measured web-traffic share and cover the overwhelming majority of browser AI-assistant use.

A named adapter is also what makes the coverage claim checkable. An assistant is either adapted or it is not, and the list says which, rather than implying that anything with a text box is handled.

The browser is the first surface, not the only one. The same pre-send posture applies wherever a person or an agent hands context to something outside the company, and MCP is the next seam that matters: an agent reaching a Model Context Protocol server is another path where content leaves before anything in the runtime has an opinion about it.

For agent workflows, VisIQ governs MCP-backed tool calls through supported runtime integrations, including the OpenClaw plugin and the OpenAI Agents SDK wrapper. That is runtime harness governance, not yet a universal standalone MCP gateway for every client, transport, resource, or prompt operation. The principle carries over unchanged. Decide in front of the send, decide locally, and leave a record of what was masked and why.