Admin guide

Deploying Cloakshot Prompt to a team with Chrome Enterprise (Google Admin console) or any tool that sets Chrome extension policies.

Cloakshot Prompt reads its team configuration from Chrome's managed storage. Anything you set there overrides the user's own settings; with lockSettings the user cannot change it. No server, proxy or agent is needed: the policy travels with Chrome's normal device management.

1. Force-install the extension

In the Google Admin console go to Devices → Chrome → Apps & extensions → Users & browsers, pick the organizational unit.
Click + → Add from Chrome Web Store, search for Cloakshot Prompt (or paste the extension ID shown at the bottom of the extension's settings page).
Set the installation policy to Force install (or Force install + pin to toolbar so the counter is visible).

If your team uses an internal AI tool on a private domain, also grant that host: in the extension's entry, under Permissions and URL access → Allowed hosts, add the site. Then list it in sites below.

2. Set the policy

In the same extension entry, open Policy for extensions and paste a JSON object. Every key is optional.

{
  "mode": { "Value": "auto" },
  "lockSettings": { "Value": true },
  "types": { "Value": ["email", "phone", "card", "cpf", "cnpj", "ssn", "iban", "secret", "ip"] },
  "keywords": { "Value": ["Acme Corp", "Project Falcon", "Jane Doe"] },
  "patterns": { "Value": ["ORD-\\d{6}", "/employee id:\\s*\\d+/i"] },
  "sites": { "Value": ["ai.acme.internal", "helpdesk.acme.com"] },
  "licenseKey": { "Value": "your-team-license-key" }
}

Key	Type	Effect
`mode`	`"ask"` · `"auto"` · `"off"`	Protection mode on every site. `auto` masks silently and shows a small notice; `ask` shows the dialog.
`lockSettings`	boolean	Users cannot change the mode, disable sites, or edit the word lists. Recommended for Team.
`types`	array of strings	Detectors to enable: `email phone card cpf cnpj ssn iban secret ip money`. Omit to use the defaults (all except `money`).
`keywords`	array of strings	Words that are always masked, case-insensitive: client names, people, codenames, internal hostnames. Each becomes `[NAME_n]`. Merged with the user's own list.
`patterns`	array of strings	Regular expressions (JavaScript syntax), optionally with `/…/flags`. Each match becomes `[CUSTOM_n]`.
`sites`	array of hostnames	Additional sites to protect beyond the default AI chats. Requires the host to be allowed in the extension's URL access (step 1).
`licenseKey`	string	Your Team license key. Activated automatically on each seat; users never see or type it.

3. Verify

On a managed device, open the extension's settings page: a yellow banner says settings are managed by your organization, and locked controls are greyed out. Open ChatGPT, paste a fake email address, and watch it turn into [EMAIL_1]. The popup's counter and the settings page's activity table show masked/sent/cancelled counts per site and day — counts only, never content — which you can export as CSV from any seat.

Cloakshot Prompt is a guardrail for everyday use, not a network DLP. It cannot see file uploads or screenshots pasted as images, and it only runs on the sites you enable. Pair it with Cloakshot for screenshots.

Other management tools

Any MDM that writes Chrome's ExtensionSettings / 3rdparty extension policies works the same way: Windows registry (HKLM\Software\Policies\Google\Chrome\3rdparty\extensions\<id>\policy), macOS configuration profiles, or Linux JSON under /etc/opt/chrome/policies/managed/. Microsoft Edge accepts the same JSON through its extension policies.

Questions or a pilot for your team: romenig@biroprincipia.com.br