[FEATURE] Governance plugin for AI browser sessions — PII protection, URL policies, action authorization, session cost caps

Problem

When AI agents use Steel Browser sessions, they operate with broad access to web content and browser capabilities. In production, this creates governance gaps:

1. PII exposure — Page content (text, form data, DOM elements) flows from the browser into the LLM context unscanned. If an agent visits a page with customer data (bank statements, medical records, user profiles), that PII enters the model context without governance.

2. URL governance — There's no policy layer controlling which URLs an AI agent can visit. An agent could navigate to internal admin panels, competitor sites, or untrusted domains without restriction.

3. Action authorization — Agents can perform any browser action — file downloads, form submissions, clicks, typing. In regulated environments, some actions need policy gates (e.g., "don't submit forms containing PII", "don't download files from unknown domains").

4. Session cost caps — Browser sessions consume resources. A stuck agent or infinite scroll loop can burn compute indefinitely. There's no per-session budget enforcement.

Proposed Solution

A governance plugin that hooks into Steel Browser's existing plugin system (CDP hooks):

[Agent Request] → [Steel Browser Session]
                       ↓
              [CDP Hook: Governance Plugin]
                       ↓
        ┌─────────────────────────────────┐
        │ • PII scan page content         │
        │ • URL allowlist/blocklist       │
        │ • Action authorization          │
        │ • Session cost tracking         │
        └─────────────────────────────────┘
                       ↓
              [Page content → Agent context]

Integration via CDP hooks:

# Steel Browser governance plugin using CDP hooks
from tealtiger import TealEngine, PolicyMode

class TealTigerBrowserPlugin:
    """Governance plugin for Steel Browser sessions."""

    def __init__(self, config):
        self.engine = TealEngine(
            policies=[
                {"type": "pii", "action": "REDACT"},
                {"type": "url_policy", "action": "ENFORCE",
                 "allowlist": ["*.company.com", "docs.google.com"],
                 "blocklist": ["*.competitor.com", "admin.*"]},
                {"type": "action_auth", "action": "ENFORCE",
                 "blocked_actions": ["file_download", "form_submit_with_pii"]},
                {"type": "cost", "action": "ENFORCE",
                 "session_limit_usd": 5.0},
            ],
            mode=PolicyMode.ENFORCE
        )

    def on_navigate(self, url, session_context):
        """registerCDPLaunchHook — evaluate URL before navigation."""
        decision = self.engine.evaluate(url, context={
            "action": "navigate",
            "session_id": session_context["session_id"],
        })
        if decision.action == "BLOCK":
            return {"blocked": True, "reason": decision.reason_code}
        return {"blocked": False}

    def on_page_content_extract(self, content, session_context):
        """Before page content enters LLM context — scan for PII."""
        decision = self.engine.evaluate(content, context={
            "action": "extract_content",
            "session_id": session_context["session_id"],
        })
        if decision.action == "REDACT":
            return decision.redacted_content
        if decision.action == "BLOCK":
            return "[GOVERNANCE: Page content blocked — PII detected]"
        return content

    def on_action(self, action_type, action_data, session_context):
        """Before executing browser action — authorize against policy."""
        decision = self.engine.evaluate(action_data, context={
            "action": action_type,  # click, type, download, submit
            "session_id": session_context["session_id"],
        })
        return decision

What this provides:

• PII scanning — Scan page content before it enters agent context. 40+ regex patterns in <2ms.
• URL governance — Allowlist/blocklist with glob patterns. Block navigation to unauthorized domains.
• Action authorization — Policy gate before file downloads, form submissions, or sensitive actions.
• Session cost caps — Track compute/time per session with hard budget enforcement.
• Decision receipts — Structured JSON audit trail for every governance decision in the session.

Why this fits Steel Browser

1. Existing plugin system — registerCDPLaunchHook and registerCDPShutdownHook provide natural integration points
2. <2ms latency — Deterministic regex + policy rules, no network call, doesn't slow down browser sessions
3. No external dependencies — Self-contained library, no API keys needed
4. Session-aware — Governance tracks state per-session (cost accumulation, action history)
5. AI agent focused — Specifically designed for AI agent governance, not generic browser security

Questions for maintainers

1. Is the CDP hook system the right place for request/response interception, or is there a higher-level plugin API?
2. Is there a way to intercept page content extraction (before it's returned to the calling agent) in the current architecture?
3. Any existing work on session resource limits or URL governance?

Contribution

Happy to submit a PR with the governance plugin. TealTiger is Apache 2.0 and already integrates with 15+ agent frameworks — the browser session governance pattern is a natural extension.