Browser extension

The PromptGlass browser extension captures AI usage in web apps like ChatGPT, Claude, Gemini, Copilot and Perplexity. It records prompts, pasted content and file uploads, and can show coaching messages inline before something sensitive is sent. It needs no network changes, so it is the fastest sensor to roll out, and it works for remote users off VPN.

What it captures

Signal	Captured	Notes
Prompt text at submit	✓	Before it leaves the browser
Paste into an AI input	✓	With source origin when available (e.g., pasted from an internal app)
File uploads	✓	File name, type, size, and content scan for supported types (PDF, DOCX, XLSX, CSV, TXT, code)
Responses	Optional	Off by default; enable per policy
Unknown AI sites	✓	Heuristics flag new AI chat UIs, which are reported to Shadow AI
Non-AI browsing	✗	The extension is inactive on sites not in the AI catalog

Inline actions

The extension can apply the same coach, redact and block actions as the gateway. A coaching message looks like this:

Heads up: this looks like customer account data. Use Copilot (Acme tenant) for customer work. [Use approved tool] [Send anyway, with reason]

Overrides and their reasons are recorded and appear in the Coaching report.

Deploy

Get the extension IDs and your tenant enrollment token from Sensors → Browser extension.

Intune

1. Devices → Configuration → Create → Settings catalog.
2. Add Microsoft Edge → Extensions → Control which extensions are installed silently with: <edge-extension-id>;https://edge.microsoft.com/extensionwebstorebase/v1/crx
3. Add Google Chrome → Extensions → Configure the list of force-installed apps and extensions with: <chrome-extension-id>;https://clients2.google.com/service/update2/crx
4. Add the managed configuration (Extension management settings, JSON):

   {
     "<chrome-extension-id>": {
       "installation_mode": "force_installed",
       "update_url": "https://clients2.google.com/service/update2/crx",
       "toolbar_state": "force_shown"
     }
   }

5. Set the policy for 3rdparty/extensions/<id>/policy: { "tenant": "acme.eu", "enrollmentToken": "…" }.

Jamf

1. Download promptglass-extension.mobileconfig from the console. It is pre-filled with your tenant and token.
2. Upload it in Configuration Profiles → Upload and scope it to the pilot group.
3. For Safari, also deploy the PromptGlass Safari app (VPP) and the profile that enables the extension.

Google Admin

1. Devices → Chrome → Apps & extensions → Users & browsers, select the OU.
2. Add the extension by ID and set Force install + pin.
3. Paste the policy JSON under Policy for extensions:

   { "tenant": { "Value": "acme.eu" }, "enrollmentToken": { "Value": "…" } }

Group Policy

1. Import the Chrome and Edge ADMX templates.
2. Set ExtensionInstallForcelist for both browsers.
3. Under HKLM\Software\Policies\Google\Chrome\3rdparty\extensions\<id>\policy create the string values tenant and enrollmentToken. Do the same under the Microsoft\Edge path.

Note

Also block unmanaged browser profiles and InPrivate/Incognito mode for AI sites (via IncognitoModeAvailability or the catalog-driven URL blocklist), or use the gateway as a backstop. Otherwise users can get around the extension.

Identity

The extension reads the signed-in managed browser profile (Entra ID or Google Workspace) and binds it to the user’s PromptGlass identity at enrollment. In combined deployments, it adds a signed identity header that the gateway trusts.

Performance and privacy

The extension runs lightweight detectors locally and sends events over TLS to ingestion. It never reads pages outside the AI catalog, and it collects no browsing history. Users can open the extension popup to see exactly what is monitored, which supports employee transparency.