A Safer Browser for AI Agents: How AWS Bedrock Uses Chrome Policies

AWS Bedrock AgentCore now supports Chrome Enterprise security policies, allowing organizations to restrict the web access of AI agents to specific domains and sites.

Why browser-based AI agents need protection

AI agents in the browser perform real business tasks: they research information on the internet, work with web applications and interact with data. Without restrictions, such an agent can potentially visit any site on the internet. For corporate security, this is a serious risk. An agent could expose confidential company data, either by accident or through a prompt injection attack, pick up malware from a fake site, or gain access to internal systems through an open browser.

Until now, companies have been cautious about running browser agents in production: there was no way to guarantee where an agent would browse and what it might accidentally disclose.

AWS addresses this with built-in support for Chrome Enterprise policies, the same access-control system that has protected corporate employees on large networks for decades. Now the same tools work for AI.

How the restrictions work on Bedrock AgentCore

Chrome Enterprise policies give detailed control over browser behavior. For AI agents on Bedrock, this means:

• Allowlist of sites: the agent can visit only the specified domains and subdomains; everything else is blocked
• Blocklist: an explicit ban on certain sites and services; everything else is allowed
• Protocol control: allow only HTTPS and block insecure HTTP connections
• Certificate verification: support for custom root CAs to work with a company's internal systems
• Logging and auditing: see in the logs which sites the agent visited and which actions it performed

This kind of control suits enterprises well: the company knows exactly where its agent can browse and can quickly detect any anomalies.

Session recording and compliance checks

AWS demonstrates a session recording tool, a video recording of all the agent's actions in the browser. It lets you see how the policies work in practice: when the browser rejects a navigation to a prohibited site, a block error is visible.

An example from the documentation: a browser agent is configured with an allowlist and can research only the AWS Bedrock AgentCore documentation and related reference materials. If someone tries to push the agent to another site through a prompt, the policy blocks the request and logs the attempt.

Custom certificates for internal systems

Many companies use their own HTTPS CAs for internal systems, which is necessary to protect confidential information. AWS shows how an AI agent can work with such systems without certificate validation errors.

AWS uses a public test site for the demonstration, but in production a company can upload its own root certificate, and the agent will access internal resources securely.

What this means for enterprises

This is critical for using AI agents at scale in production. Previously, companies were afraid to run browser agents on real tasks because it was unclear where the agent could browse and what it might accidentally disclose.

Now there is a full guarantee: the agent cannot go beyond the boundaries set by the security policies. It cannot visit external sites, cannot expose data over the internet and cannot pick up malware. That makes AI agents safer and better prepared for real enterprise deployment, where security and audit requirements are very high.