Chrome Extension Setup

The Containment.AI browser extension (Manifest V3, for Chrome and Chromium-based browsers such as Edge and Brave; Firefox support is in review) is the core component that enforces your organization's policies on prompts sent to supported AI chat surfaces. This guide covers installation, configuration, and troubleshooting.

Overview

The Chrome extension:

• Monitors what users type and paste into supported AI chat surfaces in real-time
• Sends the prompt text over an encrypted (TLS) connection to Containment.AI's policy-check service, which returns an allow/block decision before the prompt reaches the AI provider
• Retains only violation alert metadata (policy name, severity, violation message, and the matched term/pattern) for your organization's audit log — the full prompt is not stored
• Provides instant feedback when policies are triggered

Installation Methods

Manual Installation

For individual users or small teams:

1. Open the Containment AI listing on the Chrome Web Store
2. Click Add to Chrome
3. Confirm by clicking Add extension
4. Click the extension icon and sign in with your work email

note

The extension is published on the Chrome Web Store as Containment AI (extension ID cfliledfjcblpjkeiokhhdadfcpekiog).

MDM Deployment

For enterprise-wide deployment, push the extension via your MDM. Force-install requires Chrome 114 or later (Manifest V3).

The extension ID is cfliledfjcblpjkeiokhhdadfcpekiog. Use it in the examples below.

Microsoft Intune

{
  "ExtensionInstallForcelist": [
    "cfliledfjcblpjkeiokhhdadfcpekiog;https://clients2.google.com/service/update2/crx"
  ]
}

Jamf Pro

1. Create a new Configuration Profile
2. Add Chrome extension policy
3. Set Extension ID to cfliledfjcblpjkeiokhhdadfcpekiog and update URL to https://clients2.google.com/service/update2/crx
4. Deploy to target computers

Google Workspace Admin

1. Go to Admin Console > Devices > Chrome > Apps & Extensions
2. Add by extension ID cfliledfjcblpjkeiokhhdadfcpekiog
3. Select Force Install
4. Apply to relevant organizational units

See MDM Integration for detailed instructions for each provider.

Configuration

Automatic Configuration

When you sign in to the extension:

• It automatically connects to your organization
• Policy configuration is synced from your dashboard periodically (about every 5 minutes), with a connection health check every 30 seconds

Organization ID (managed storage — planned)

note

Zero-touch enrollment via managed storage is planned, not yet shipped. The extension declares a managed-storage schema (with an orgId key), but released versions do not read chrome.storage.managed — admin-pushed values are ignored. Today, each user connects the extension by signing in with their work email. Force-install via MDM works today; see MDM Integration.

Fail-Closed Behavior

The extension defaults to fail-closed: if the policy-check service is unreachable or the extension is unauthenticated or misconfigured, submissions are blocked rather than permitted. The fail policy is part of your organization's policy configuration (not a per-extension setting): closed is the default and recommended for regulated environments; open allows submissions when the service is unreachable, for a lower-friction experience. Fail-open allows are recorded and synced to your audit log when connectivity returns.

How It Works

Policy Enforcement

When you interact with a supported AI chat surface:

1. Input Monitoring - The extension captures the prompt text you type or paste on submit
2. Policy Evaluation - The prompt text is sent over TLS to Containment.AI's policy-check service, which evaluates it against your organization's active policies
3. Action Taken - The service returns a decision before the prompt reaches the AI provider, following your organization's violation policy:
   • Block: The submission is prevented and the user sees a warning; a violation alert is recorded
   • Allow (monitor): The submission proceeds and a violation alert is recorded

Supported Platforms

The extension works with these AI chat surfaces:

• ChatGPT (chat.openai.com, chatgpt.com)
• Claude (claude.ai)
• Google Gemini (gemini.google.com)
• Microsoft Copilot (copilot.microsoft.com)
• Grok (grok.com)

note

The monitored platform set is fixed in released extension versions. The planned managed-storage schema declares an allowedDomains key for adding internal or enterprise LLM front-ends, but released versions do not yet read managed storage — contact your account manager if you need additional surfaces covered.

Data Privacy

How prompt content is handled:

• On submit, the prompt text is sent over an encrypted (TLS) connection to Containment.AI's policy-check service solely to evaluate it against your policies
• The policy check does not store the full prompt — only violation alert metadata (policy name, severity, violation message, and the matched term/pattern) is retained for your organization's audit log
• Prompt content is never sold or shared with advertisers or data brokers
• Sessions are stored in chrome.storage.local on each device and are not synced across devices
• The policy-check endpoint is https://proxy.containment.ai, fixed at build time in released versions. A managed-storage override (proxyUrl) for on-prem or sovereign-cloud deployments is on the roadmap — see Offline Pipelines

Extension Interface

Popup Menu

Click the extension icon to see the protection status and sign in or out. The popup shows one of these statuses:

Status	Indicator	Meaning
Protected	Green	Signed in and connected — policy protection active
Sign in required	Yellow	Sign in with your work email to enable protection
Limited Protection	Orange	Security service unreachable (your organization's fail policy is open)
Disconnected	Red	Cannot reach the server — submissions are blocked (fail-closed)
Error	Red	Status could not be determined — use Retry

The extension icon does not show a numeric badge; open the dashboard's Alerts page to review policy triggers.

Troubleshooting

Extension Not Working

Symptoms: No policy enforcement, no alerts

Solutions:

1. Click the extension icon to check the protection status
2. Ensure you're signed in with your work email (use Sign In in the popup)
3. If the popup shows an error, click Retry
4. Disable and re-enable the extension
5. Check that the site isn't in your browser's restricted list

Policy Not Triggering

Symptoms: Expected violations not detected

Solutions:

1. Verify the policy is enabled in the dashboard
2. Check that the AI platform you're using is a supported surface
3. Review the policy's configuration
4. Test with the exact pattern the policy is designed to catch

Slow Performance

Symptoms: Lag when typing in AI platforms

Solutions:

1. Check for conflicting extensions
2. Clear browser cache
3. Ensure you have the latest extension version
4. Contact support if issue persists

Sign-In Issues

Symptoms: Can't sign in to extension

Solutions:

1. Ensure you're using your work email
2. Check your email domain is registered
3. Try signing in through the dashboard first
4. Clear extension data and retry

Updates

The extension updates automatically through Chrome. To manually check:

1. Go to chrome://extensions
2. Enable Developer Mode
3. Click Update

Uninstalling

To remove the extension:

1. Right-click the extension icon
2. Select Remove from Chrome
3. Confirm removal

warning

Uninstalling the extension removes protection from that device. For MDM-managed extensions, users may not be able to uninstall.

Security

Permissions Explained

The extension requires exactly two permissions:

Permission	Purpose
storage	Persist the auth session and cached policy configuration locally on the device
alarms	Schedule the periodic config sync and connection health checks

Host permissions are limited to Containment.AI infrastructure (*.containment.ai for the dashboard and policy-check gateway, *.supabase.co for authentication). The extension's content scripts run only on the supported AI chat surfaces listed above — it does not request activeTab, tabs, or broad host access.

Code Security

• Extension code is reviewed for security
• Updates go through the Chrome Web Store review process
• Prompt content is never sold or shared with advertisers or data brokers

Support

If you encounter issues:

1. Check this documentation
2. Review the Troubleshooting section
3. Contact support@containment.ai