AI agents

Browser agents

AI-enabled browsers act autonomously inside sessions a human already signed into. Every request they make looks like an authorized user doing authorized work, because in every respect except intent, it is.

In short

A browser agent inherits a person's identity, their session, and their permissions, then acts on its own. Network controls see approved traffic to approved destinations and pass it. Certiv sits in the execution path on the endpoint and evaluates what the agent is about to do against policy, before it does it.

Why the session is the hiding place

It is already authenticated

The agent acts inside a session a human opened and a human authorized. To anything watching the wire, the requests are the logged-in user doing their job.

The traffic is sanctioned

It goes to applications the organization approved, over TLS, from a managed machine. Nothing about the destination looks wrong, because nothing about the destination is wrong.

Sensitive data leaves as page context

AI-enabled browsers pass what is on screen to cloud backends to reason about it. The interesting question is not whether that request is permitted, but what was in it.

The action is the risk, not the request

Reading a record and exporting every record are the same protocol to a proxy. The difference lives in what the agent is about to do, which is a decision, not a packet.

Govern the action, not the request

Controls that work by inspecting traffic have to decide from what the wire shows them. For a browser agent the wire shows a permitted user reaching a permitted system, which is why the answer is almost always allow, and why that answer is almost always right about the request and silent about the consequence.

Certiv sits in the execution path instead. Each action is intercepted and evaluated against enterprise policy with full session context, then allowed, blocked, redirected, or escalated to a human before it executes, and every decision is recorded as audit evidence. Coverage never depends on traffic crossing a proxy.

Straight Answers

What Teams Ask About Browser Agents

Expand to view common questions.

What counts as a browser agent?
Any AI agent whose work happens through the browser: an AI-enabled browser acting on the page, an extension that takes actions on a site, or an agent driving a web application on a person's behalf. Certiv treats them as agents like any other. Scout observes AI agent activity regardless of which platform or framework the agent runs on, including coding agents, browser agents, MCP servers and internal copilots.
Why do network controls struggle here?
Because the agent operates inside an authenticated session, to an approved destination, from a managed device. A gateway, proxy, or CASB sees an authorized user making authorized requests. What it cannot see is intent: whether this is one record being read or a whole table being exported. Certiv evaluates the action rather than the traffic, in the execution path, before it runs.
Does this mean Certiv watches what people browse?
No. Scout observes AI agents and agentic activity, not everything a person does on their workstation. It does not monitor browser history, record keystrokes, or indiscriminately inspect documents. If an AI agent is not involved, Certiv is not looking. Privacy Mode goes further: routine, policy-compliant agent work stays private by default.
Do we need a connector for each browser or site?
No. Because Scout observes agent activity at the endpoint, coverage does not depend on a connector existing per tool. Certiv deploys through existing MDM onto macOS, Windows and Linux, and the Policy Engine enforces against hosted and locally-run models alike.

See Certiv on Your Own Endpoints

Deploy in minutes. See every agent, then control what happens next.

Book a Demo

Keep reading

Shadow agents

The agents nobody filed a ticket for, and why discovery alone changes nothing.

Certiv vs. CASB

What a control built around sanctioned SaaS traffic can and cannot decide.

Pre-execution policy enforcement

The mechanism: intercept, evaluate, and enforce policy on every agent action before it runs.