Every one of these guides assumes the same primitive: one HTTP request that resolves a URL to a page type before the agent is allowed to fetch it. What changes is where you put that call, and what you do with the answer.
Whatever framework you are in, the shape is the same. Resolve the URL, read the verdict, act on it, log it. The guides differ in where that call is physically placed — a tool wrapper, a guardrail hook, a route interceptor, an MCP server, or a proxy.
# resolve the destination before the agent fetches it GET https://www.aiagentallowlist.com/api/check?url=https://stripe.com/login # => {"result":"deny", "id":"login"} # the agent never sends the request. the decision is logged either way.
Before any code: decide what the default is, which page types get carved in, and how the rules are written down in a form a reviewer can read. Start here if you have not settled the shape of the policy itself.
The framework-agnostic reference implementation end to end: policy design, the enforcement hook, default-deny, logging and a launch checklist.
FoundationalWhy default-allow fails, the carve-in methodology for building the allow set, and a staged rollout from log-only to flag to enforce.
FormatA fully annotated policy file format: allow, deny and flag rules combining page types, IAB categories and filtering conditions.
Highest severityWhy login is the highest-severity page type, and how verified login URLs — not guessed paths — deny it before a credential is ever sent.
TransactionsCart, checkout and payment carry different risk levels. How to deny transactions by default and design the rare human-approval exception correctly.
Six framework-specific guides. Each shows the hook point that framework exposes, an illustrative code sketch, and the failure mode to watch for — usually an escape hatch where the agent can navigate without passing through your check.
A tool-wrapper pattern that restricts which URLs an agent's tools can reach, with a code sketch calling the page-type lookup.
OpenAI Agents SDKA guardrail-hook pattern that checks a URL's page type before the tool call runs, denies with a specific reason, and logs the decision.
MCPPut the check inside the fetch/browse tool server itself, so every client that connects inherits the guardrail regardless of framework.
PlaywrightEnforce policy with page.route() interception and a page-type lookup, before any request reaches the network.
browser-useInjecting the policy check at the navigation-hook level of an open-source browser-agent library.
Computer useA computer-use agent sees pixels, not a URL bar. Why the check has to run at the browser or OS layer instead.
The part that gets skipped and then needed urgently. What to log, how to keep latency inside budget at volume, how to tell whether the data you licensed is any good, and how URL policy contains an injection that already succeeded.
Cache layer, lookup, decision logic, audit log, and a realistic latency budget for checking every navigation at volume.
AuditWhat to record per decision — URL, page type, rule fired, verdict, agent ID, timestamp — plus retention and incident-review structure.
Blast radiusHostile pages redirect agents via injected text. A URL policy layer contains the damage even when the injection wins at the model layer.
EvaluateTesting coverage and accuracy with the free 100-domain sample before you buy: what “verified” means, and how to spot-check it honestly.
The 2026 incidents — the Hugging Face breach, the DseWiki hijack, the JFrog Artifactory covert channel, a run of third-party account takeovers — are worth reading before you design your rule set, because they show which surfaces agents actually reach when they drift. Our analysis shows the documented attack steps in almost all of them would have been denied at the request.
See the incident-by-incident prevention analysisTwo companion products are included with every database license and are worth reading alongside these guides: the Egress Rules Library, roughly 40 method-aware URL-pattern rules that classify a URL on any domain pre-request, and the High-Value Host List, around 60 curated dangerous hosts including cloud metadata endpoints and registries. Start testing against the free sample CSV, then check pricing.
Guides assume you have already decided this layer belongs in your stack. If you have not, or if you need the field-level detail, start in one of these.
Verified URLs vs guessed paths, credential surfaces, and why a prompt instruction is not a control.
Reference — 6Full schema, coverage tiers, how login and checkout URLs are found and verified, API shape.
Use cases — 15Fifteen worked jobs with the allow and deny sets each one actually needs.
