agent guardrails, done at the URL level

Prompts don’t stop agents. Policy does.

Every agent incident follows the same script: the model was told not to do something, then a cleverly structured page or an ambiguous task led it there anyway. Instructions are suggestions. A guardrail has to be deterministic and external to the model — a check the agent cannot be talked out of. That check needs data: which URL is a login page, which is a checkout, which is safe to read.

See the policy data OEM licensing

The problem

Domain-level control is too blunt for agents

Web filtering was built for humans: block a domain, done. Agents break that model — they need to use the same domains they must be constrained on.

Domain blocklists fail agents

Block amazon.com → the procurement agent can’t research products at all
Allow amazon.com → nothing stops it at the checkout
Guessed paths (/login, /signin) miss localized, subdomained real URLs
Prompt-level rules collapse under prompt injection on hostile pages
Post-hoc audit logs discover the incident after the damage

Page-type policy fits how agents work

Allow product & pricing pages; deny checkout & payment — on the same domain
Verified URLs mean the check matches the site’s reality, not a guess
Enforced in the framework or gateway — outside the model’s reach
Default-deny for credential surfaces across millions of domains at once
The agent is stopped before the click, not flagged after

# the policy your agent framework enforces on every navigation
allow: [pricing, documentation, blog, about, contact, status, careers]
deny: [login, checkout, payment, account, signup] # default-deny, no exceptions without human approval
# resolved per-URL via the AI Agent Allowlist page-type map — deterministic, model-independent

Who ships this

Three places the guardrail lives

Agent platforms

Browser-agent and computer-use products embed the page-type map so every customer gets “never touches logins or checkouts” as a product guarantee — the line that closes enterprise deals.

AI gateways & guardrail engines

Gateways already inspect prompts and tool calls. Adding URL policy closes the web-access gap: one lookup per navigation, allow or deny before the request leaves.

Enterprise security teams

SSE, enterprise-browser and zero-trust stacks extend existing category-based filtering with page-type rules for the agent traffic now flowing through them.

Allowlist or blocklist? Both are views of the same data. Mature deployments run default-deny with an allowlist for actions (safest), plus a hard denylist for credential and payment surfaces as a second net. The database powers either policy shape — you choose the default.