Skip to main content

Set Up the Browser Extension

Tasks

Deploy the AIControls Chrome extension to your managed fleet so browser-based AI tool usage appears in Security → Shadow AI. The extension is configured entirely through enterprise policy — employees cannot change or disable it. For the model behind this feature, see Shadow AI Discovery.

Prerequisites​

  • AIControls admin access
  • An MDM / browser management platform that can force-install a Chrome extension and push a managed policy — Google Admin, Microsoft Intune, or Jamf
  • Employee disclosure of monitoring in your acceptable-use policy

Mint a fleet-ingest token​

One token covers your whole fleet: it reports usage on behalf of each employee's identity (templated per user by your MDM), rather than requiring a separate token per machine.

  1. Go to Security → Shadow AI and click Set up browser extension.
  2. Click Generate fleet token. AIControls creates a fleet-ingest token and displays it once — copy it now.
  3. The dialog also shows the managed policy JSON with the token pre-filled. Copy it for the next step.
warning

The token is shown only once. If you lose it, generate a new one and update your MDM policy — the old token can be revoked from the same page.

Push the managed policy​

The extension reads its configuration from Chrome's managed storage. Push this policy through your MDM alongside the force-install rule:

{
  "serverUrl": { "Value": "https://YOUR_WORKSPACE_URL" },
  "token": { "Value": "aic_fleet_..." },
  "developerId": { "Value": "${user.email}" },
  "deviceId": { "Value": "${device.serial}" },
  "orgId": { "Value": "acme" },
  "enabled": { "Value": true }
}
KeyRequiredDescription
serverUrlyesYour AIControls workspace URL
tokenyesThe fleet-ingest token from the previous step
developerIdrecommendedEmployee email — template it per user (e.g. ${user.email}) so usage attributes correctly
deviceIdoptionalDevice/asset identifier, used for tamper detection
orgIdoptionalOrg identifier
enabledoptionalMaster switch, default true
  1. Force-install the extension: set ExtensionInstallForcelist (Google Admin, Intune, or Jamf) to the extension ID and update URL provided in the setup dialog.
  2. Push the managed policy JSON above via your MDM's managed-storage mechanism for that extension ID.
  3. Make sure developerId is templated to the signed-in user so each visit is attributed to the right employee.

Verify​

  1. On a managed machine, confirm the extension is installed and that chrome://policy shows your managed values loaded.
  2. Visit a known AI tool such as chatgpt.com.
  3. Within about a minute, the visit appears under Security → Shadow AI → Usage, attributed to that employee.

Enforce policy on a tool​

Once usage is flowing, you can act on any tool:

  1. On the Usage tab, find the tool and set its enforcement mode: Notify, Warn, Redirect, or Block.
  2. The extension pulls policy periodically, so the change reaches employees within minutes.
  3. Re-visiting the tool on a managed machine now shows the warn banner, redirect, or block page according to the mode you set.

See Shadow AI Discovery → Enforcement for what each mode does.

Troubleshooting​

No usage appears​

Confirm chrome://policy shows serverUrl and token loaded, and that the workspace URL is reachable from the machine. A missing or mistyped token means events are rejected.

Usage attributed to the wrong person​

Check that developerId is templated per user (${user.email}) in the managed policy rather than a static value.

Enforcement not applying​

Enforcement is pulled on an interval — allow a few minutes, or reload the extension on the test machine to apply immediately.

Last updated on