Chrome Extension Integration

The Chrome extension is the core component that enforces policies in the browser. This guide covers configuration and management.

Extension Overview

The extension:

• Monitors AI platform interactions on supported surfaces
• Enforces policies in real-time (allow/block decision before the prompt reaches the AI provider)
• Reports violation alerts to the dashboard
• Applies your organization's fail policy (open or closed) when the policy-check service is unreachable

Installation Options

Individual Installation

The extension is published on the Chrome Web Store as Containment AI (extension ID cfliledfjcblpjkeiokhhdadfcpekiog). Users install it directly:

1. Open the Containment AI listing on the Chrome Web Store
2. User clicks "Add to Chrome"
3. User signs in to the extension to connect it to your organization

MDM Push

Deploy via device management:

• Intune Setup
• Jamf Setup
• Google Workspace Setup

Group Policy (Windows)

Deploy via Windows GPO:

{
  "ExtensionInstallForcelist": {
    "Value": ["cfliledfjcblpjkeiokhhdadfcpekiog;https://clients2.google.com/service/update2/crx"]
  }
}

Configuration

Organization Settings

Configure at Settings > Integrations > Chrome Plugin:

Setting	Description
MDM Provider	Record which MDM you deploy with (Jamf, Intune, or other)
Install Mode	Force install or self-service catalog

Enforcement Behavior

Enforcement is driven by your organization's policy configuration, not per-extension settings:

Behavior	Description
Violation policy	Block or allow-and-record violating submissions
Fail policy	When the policy-check service is unreachable: closed blocks submissions, open allows them

Policy Sync

The extension keeps itself current automatically:

Mechanism	Interval
Configuration sync	Every 5 minutes
Health check	Every 30 seconds

note

Per-organization UI customization — custom block/detect message text, notification styles, sounds, update channels, and allowlist/blocklist scoping of where the extension runs — is not configurable today. The extension runs on its supported AI platforms (see below) with a fixed block experience. If custom messaging is a requirement for your deployment, contact your account manager.

Monitored Platforms

The extension monitors a fixed set of AI platforms:

• ChatGPT (chatgpt.com, chat.openai.com)
• Claude (claude.ai)
• Gemini (gemini.google.com)
• Microsoft Copilot (copilot.microsoft.com)
• Grok (grok.com)

Per-site rules and corporate notices for these platforms are managed through Site Controls.

Monitoring

View deployment health on the Devices page:

• Connected devices and their status
• Devices appear after a user signs in to the extension

Troubleshooting

Extension Not Working

1. Check Installation

   • Verify the extension is installed and enabled at chrome://extensions
   • MDM-deployed installs show a "Managed" badge

2. Check Connection

   • Click the extension icon
   • The popup shows the current status: protected, sign-in required, disconnected, or limited protection
   • If sign-in is required, sign in with your work account

3. Check Policies

   • Configuration syncs automatically every 5 minutes
   • Signing out and back in forces a fresh configuration fetch

Common Issues

Symptom	Likely Cause	Solution
Sign-in required	Not authenticated	Sign in via the popup
Disconnected	Policy-check service unreachable (fail-closed org)	Check network/firewall access to containment.ai
Limited protection	Policy-check service unreachable (fail-open org)	Check network/firewall access to containment.ai

Updates

Automatic Updates

Extensions update automatically via the Chrome Web Store.

Forcing Updates

MDM can require a minimum version:

{
  "ExtensionSettings": {
    "cfliledfjcblpjkeiokhhdadfcpekiog": {
      "minimum_version_required": "1.0.1"
    }
  }
}

Security

Permissions

The extension requests a minimal permission set:

• storage - Persist the auth session and cached policy configuration on the device
• alarms - Schedule the periodic configuration-sync and health-check timers

It runs content scripts only on the monitored AI platforms listed above, plus host permissions for Containment.AI services (policy checks, auth).

Data Handling

• On submit, the extension sends the prompt text over TLS to Containment.AI's policy-check service, which returns an allow/block decision before the prompt reaches the AI provider.
• The policy check does not store the full prompt. Only violation alert metadata is retained for the organization audit log: policy name, severity, violation message, and the matched term or pattern.
• Prompt content goes only to the policy-check service, solely for evaluation. It is never sold or shared with advertisers or data brokers.
• Sessions are stored in chrome.storage.local (per-device, not synced).

Code Security

• Signed by Containment.AI
• Built on Chrome MV3 with a minimal permission set
• Regular security audits

Related Topics

• Quick Start - Initial setup
• MDM Integration - Enterprise deployment
• Site Controls - Per-site configuration