Some companies run agents and need to bound them. Others build the products that other people's agents run inside, and need the guardrail as a shipped feature. The requirements diverge sharply — on licensing, on deployment, on who signs the approval.
The split below decides almost everything downstream: whether you want the lookup API or a perpetual on-premise license, whether the buyer is a product manager or a risk committee, and whether the deliverable is an integration or a signed policy document.
Agent platforms, AI gateways, enterprise browsers, SSE vendors, MSSPs and RPA vendors embed the page-type database so their own customers inherit the guardrail without configuring anything.
Banks, insurers, public sector bodies, merchants and legal teams need a default-deny policy they can defend to an auditor, with residency and jurisdiction fields attached to the data.
Seven guides for companies whose product sits in the path of someone else's agent traffic. Each covers the integration shape, the OEM data motion and what the end customer sees.
OEM the page-type database and ship “never touches logins or checkouts” as a deterministic product guarantee rather than a system prompt.
ReadGateways inspect prompts, tool calls and output — but not the URLs agents navigate to. One deterministic lookup closes that gap.
ReadCategory filtering tells the browser what a site is. Page-type rules tell it what page the agent is standing on.
ReadYour category feed already moves on a schedule. Adding a page-type field to it is a data-motion change, not an architecture change.
ReadPackaging the database, the egress rules and the host list into a managed agent-security offering you bill for, with SOC integration.
ReadRPA bots were scoped by selectors. Agents have none. How to restore a bounded action set during the migration.
ReadYou gave your chatbot a browse tool, not a blank check to the internet. One pre-flight lookup denies login, checkout and exfil-sink URLs first.
ReadFive guides for organizations where an agent's browsing history is going to be read back by someone with authority. The common thread is default-deny plus a navigation log that survives review.
Default-deny is not caution, it is the only defensible default. Jurisdiction fields, auditable navigation logs, verified URLs at scale.
ReadLet claims-research agents read repair and regulatory pages freely, while carrier logins, EFT and payment surfaces stay denied.
ReadProcurement-grade governance: an on-premise, no-callback database with default-deny rules an evaluator can actually score.
ReadThe merchant's own view: steer shopping agents onto product and pricing pages while cart, checkout and login stay gated.
ReadWho approves an agent's web-access policy, how the sign-off workflow runs, and how the result gets audited.
Read2026 produced several public cases of AI agents escaping their task or being steered off it: the Hugging Face breach, the DseWiki wiki hijack, a covert channel through JFrog Artifactory, and a series of third-party account takeovers. Our analysis shows the documented attack steps in almost all of them would have been denied at the request, by the page-type database and the roughly 40 egress rules together.
Every 2026 agent escape, mapped to the rule that stops itEvaluating before you buy: the free sample CSV has 100 real domains in the production schema, the schema reference documents every column, and pricing lists all tiers. If the problem is staff reaching AI tools rather than agents reaching the web, see webfilteringdatabase.com.
Knowing your constraints is the first half. The second half is where the check runs and what it costs you in latency.
Reference implementation, framework hooks, policy engine architecture, audit logging.
Compare — 8Honest TCO on crawling it yourself, plus where proxies, robots.txt and bot detection actually belong.
Reference — 6Schema, coverage tiers, detection methodology, API shape.
