Stop a labeled file in the browser
GenGuard asks TAO before a paste, drop, or file picker hands a labeled file to the page, including images and PDFs.
Stop a labeled file in the browser
FileGuard remembers the file. GenGuard is the control that stops it leaving through Chrome or Edge. The two modules share the TAO agent on that station. GenGuard does not open its own channel to the Cloud Portal for this check.
What the browser holds
Before the page receives a file, GenGuard holds:
- A paste of a file, including from the clipboard
- A drop onto the page
- The file picker, including Browse and the system open dialog the page calls
The hold covers text files, Word, Excel, PowerPoint, PDF, and common images (png, jpeg, gif, bmp, webp).
Word, Excel, and PowerPoint text is read in the browser extension and checked against the GenGuard keyword and pattern lists. PDF and images are read on the station by TAO. A file that already has a FileGuard label is blocked from the label alone, even when the page never shows its text.
If the station says the file is allowed, the page receives it. If the station says it is labeled, the person sees a GenGuard block and the page does not.
What this is not
Classification of an image or a PDF is enforced in the browser. GenGuard inside TAO still gates clipboard text, keyword files, and the desktop apps you configured as contexts. Dragging a labeled picture into a desktop application is that workstation control, not this browser check.
A station on an older agent keeps its existing GenGuard behavior. Classified-file checks start after that station is on a TAO build that includes FileGuard, with the current GenGuard extension installed.
Validate
- Classify a pilot file that contains nothing you cannot afford to handle in a test. A short Office file or a screenshot of a test page is enough.
- Confirm the finding says Classified and that the station has checked in since the label was saved.
- In Chrome or Edge, on a site where GenGuard is active, paste, drop, or pick that file.
- Expect a block, and a Live Event for the GenGuard action.
- Repeat with a file that has no label and no forbidden words. Expect the page to receive it.
Do not use a production secret as the first test.