Part of the Paladin docs.
A browser agent's raw material is pages nobody on your team wrote. Paladin gives that surface two decision points. Before a navigation, the URL is checked against threat reputation, structural risk, and your policy, and a denied page is never fetched. After a page loads, its content is scanned for prompt injection and classified for sensitive data before your code hands it to the model.
There are two integration depths, and they compose. The zero-code depth is the forward proxy: point the browser session's proxy setting at Paladin and every connection from that session is authenticated and checked against the real resolved address before it opens, which also closes the DNS-rebinding trick that defeats name-based checks. The content-aware depth is a request hook in the agent's page loop that asks Paladin to authorize each page and to clear each page's content. The repo ships a reference Playwright integration for CDP-driven browsers.
Session taint carries across both. Once a session has read private data and ingested untrusted content, its next outbound call to an unapproved destination is held, and so is a navigation whose URL could carry data out. That is what catches the injection that was too subtle to flag on the page.
What the browser surface does not cover, stated plainly: Paladin does not gate individual clicks, keystrokes, or form fills, and does not gate file uploads or downloads. The proxy sees destinations, not page content, so content checks need the hook in the agent's path. Browser-surface benchmark results are directional so far and are published with their method on the benchmarks page.
Previous: Writing policy.
Cortexa Labs, Inc.