Skip to content
AgentIDDocs

Type at least two characters to search titles, headings and content.

↑ ↓ to navigate↵ to open
AgentID Docs

Integrations

Rollout with Chrome policy

Roll the browser extension out to teams with enrollment tokens and managed Chrome policy, so users never handle a raw API key.

For more than a handful of users, distribute the extension centrally. Each rollout bundle contains an enrollment token that the extension exchanges for its runtime credentials, so no long-lived API key is pasted into a popup.

Choose a key strategy

StrategyAttributionTrade-off
Department Keys (recommended for pilots)Per departmentOne shared system, a separate key per department
One Shared KeyNone beyond the systemFastest, but a leaked key affects everyone
Per User KeysPer personStrongest attribution, more to manage

Keep one AI system as long as departments share the same guardrails and content policies. Split into separate systems when a group needs materially different policies.

Generate a rollout bundle

Open Integration

Open the browser system's Integration tab and find Generate Managed Rollout Bundle (admins only).

Describe the rollout

  • Rollout Key Name, for example Sales Chrome Extension
  • Owner Label, for example sales@company.com
  • Environment: Prod, Staging or Dev
  • Bootstrap Protection Mode: Fail Closed or Fail Open. It applies only while the extension cannot read the live system configuration; normally Shadow Mode and Strict Security from Guardrails decide.
  • Enrollment Token TTL (hours): default 168 (7 days), maximum 720 (30 days)

Generate

Click Generate Rollout Bundle. AgentID creates a dedicated API key, wraps it in an enrollment token, and returns:

  • Managed Policy JSON for Chrome enterprise policy,
  • Manual Enrollment Config and Popup Fallback values for users without managed policy.

The bundle shows the key prefix and when the token expires.

Repeat per department. Every department shares the System ID and guardrails but has its own key, so activity is attributable by key prefix and owner label.

Per-user enrollment without SSO

Under Enroll multiple users without SSO, enter up to 50 e-mail addresses (one per line) and click Generate user enrollments. Each user gets the same System ID but a unique enrollment token and API key identity, so activity and AI discovery are attributable per person. Download the CSV and distribute it through an approved secure channel; it contains credentials, so delete it after installation.

Push the managed policy

The extension reads its configuration from Chrome managed storage. The policy object is the same for every management tool:

managed-policy.jsonJSON
{
  "enabled": true,
  "baseUrl": "https://app.getagentid.com/api/v1",
  "enrollmentToken": "aid_ext_enroll_...",
  "protectionMode": "fail_closed"
}
enabledboolean

Turns protection on or off.

baseUrlstring

AgentID API base URL.

enrollmentTokenstring

Token from the rollout bundle. Preferred over systemId and apiKey.

protectionMode"fail_open" | "fail_closed"

Bootstrap failure behaviour. Defaults to fail_closed when managed policy is active.

systemIdstring

Legacy: System ID for key-based setup.

apiKeystring

Legacy: raw API key. Avoid in enterprise rollouts.

ssoMode"off" | "audit" | "required"

Browser extension SSO mode.

ssoProviderIdstring

SSO provider ID configured for the system.

Deliver it with the channel you already use:

ChannelWhere the policy goes
Google Admin / Chrome Browser Cloud ManagementExtension policy for the AgentID extension ID
Windows registry (GPO, Intune)HKLM\Software\Policies\Google\Chrome\3rdparty\extensions\<EXTENSION_ID>\policy with the keys above
macOS configuration profilePreference domain com.google.Chrome.extensions.<EXTENSION_ID> with the keys above
LinuxChrome managed policy files

Use the published extension ID, not the ID of an unpacked local copy. The Chrome Web Store ID of AgentID Browser Protection is konaflpebgjmcejanoipmeggkifilnkc. To install the extension without user action, also add it to your browser's force-install list.

When managed policy is active:

  • managed values override popup values and are read-only in the popup,
  • protectionMode defaults to fail_closed: if Guard, the network or the configuration fails, the prompt is not sent,
  • the enrollment token is redeemed for the runtime System ID and API key automatically.

Manual fallback

Users without managed policy open the popup, expand Managed deployment options, enter the Base URL and Enrollment Token from the bundle, and click Save & test connection.

Browser Extension SSO

Browser Extension SSO on the Integration tab adds per-user identity to browser activity with OIDC or SAML 2.0:

  • SSO Mode: Off, Audit only (record identity) or Required (prompts need a valid SSO session),
  • Allowed Email Domains, Required Groups and Required Roles restrict who counts as signed in.

Users sign in from the popup with Sign in with SSO. With SSO required, prompts without a valid session are blocked.

Verify the rollout

In the activity log, check the provider mix, the key prefix and owner label per department, and the blocked, masked and allowed events. The Integration tab also shows adapter health per app: last seen, extension version and whether the composer and send button are detected.