Island launches enterprise browser built to control AI agents

Island has launched an Enterprise Browser for Agents, a product designed to let organisations apply the browser controls they already use for human employees to AI agents that browse, read and act across corporate systems. The launch, announced 13 November 2026, lands as businesses start handing agents routine work — updating customer records, onboarding staff, processing invoices — and discover those tasks need the same oversight a human gets at a keyboard.

The stakes are straightforward. Agents doing real work need access to SaaS tools, internal applications and public websites. Until now, many organisations have relied on what Island calls patchwork arrangements built on consumer browser infrastructure, which the company argues creates risks around credentials, data handling and changes to records. The question for employers is shifting from whether agents can complete tasks to how their actions get identified, limited and recorded across the same applications staff use every day.

What does the product actually do?

Island's approach is to govern the browser, not the agent. Policy is enforced at the browser activity level, whenever an endpoint or cloud agent calls the browser or touches internal resources. That includes controls over data movement, credential use and outputs. It is a deliberate architectural choice: rather than trying to build guardrails into every agent framework, Island puts the guardrails in the layer the agent cannot avoid using.

The browser deploys on devices and in the cloud, covering both local and remote agents. Notably, it does not rely on a cloud-hosted browser running outside the customer's environment — a meaningful distinction for companies with strict data residency or security postures.

"Island already had what agents need: identity federation, data boundaries, credential isolation, and full attribution, all proven in production," said Dan Amiga, Chief Technology Officer and Co-founder at Island. "Agents inherit Island's security model on day one, with policies built specifically for them."

In short: the mechanism is policy enforcement at the point of browsing, not agent-side restriction.

Which controls ship in the browser engine?

A core part of the launch is a set of controls built directly into the browser engine — and Island says these cannot be disabled or bypassed by end users or by agents. That claim matters, because a control an agent can switch off is not really a control.

The built-in controls include:

• Governed access to browser tools and pages, with permissions set per agent and per application.
• Fine-grained page permissions. Policy can define which document object model operations are allowed, and whether an agent can write or only read.
• A governed model context protocol layer. Agents receive only the functions policy authorises — nothing more.
• Identity inheritance. Agents inherit the user's identity and permissions, and policy can apply to the user alone, the user and agent together, or the agent separately.
• Read-only mode for sensitive systems, letting agents extract information from systems of record such as ERP platforms without being able to modify, submit or delete data.

The identity model is worth pausing on. Because agent activity ties to enterprise identity, an administrator can answer the basic question auditors ask: who — or what — did this? Logs record whether an action came from a human or an agent, and sessions can be recorded for visual playback of pages, clicks and form submissions.

How does it handle credentials and data leakage?

Credentials are one of the sharpest edges in agentic browsing. The browser includes a credential vault that injects passwords directly into login forms — including for applications without identity provider integration — so credentials never pass through the model context window. That closes a real gap: agents that see plaintext passwords in their context can leak them in logs, tool calls or model outputs.

On data handling, the browser can inspect rendered content, clipboard operations, file uploads, print jobs and screen captures before encryption. That inspection point is the control surface: it is where policy decides what leaves the enterprise.

For internal application access, Island says its zero-trust network access connectors expose only approved applications and block wider lateral movement across a network. The company has also included monitoring tools that measure page load times, interaction latency, errors and completion rates in agent sessions — operational telemetry that treats agent browsing as something you manage, not just something you permit.

Why is Island talking about token costs?

The launch also targets the cost of agentic browsing, an angle that gets less attention than security but hits budgets directly. Island argues that browser extensions relying on screenshots force models to interpret pixels rather than structured page data, while sending raw HTML, CSS and JavaScript through models can balloon token use.

Its answer is an annotation-based application programming interface for page parsing, which the company says reduces token consumption and can improve the reliability of interactions. The system also learns from repeated workflows — remembering navigation paths and pre-loading resources for recurring tasks. Fewer tokens per task, and faster repeat runs, change the economics of putting agents on routine browser work.

Cheaper, more predictable agent sessions make broad deployment plausible rather than experimental.

Does the same rulebook apply to humans and agents?

Island says it has applied the same policy framework used in its existing enterprise browser for human workers to this new product — and the company claims credit for defining the enterprise browser category in the first place. That continuity is the pitch: organisations do not need a second governance regime for software workers, just an extension of the one they already run.

"Within a few years, most enterprises' browser activity will come from agents, not people," said Amiga. "Organisations that treat agent browsing as a separate problem end up running a second workforce nobody can see. Whether an agent needs a browser, local desktop resources, or upstream MCPs and LLMs, Island is there."

The framing puts Island in the middle of a wider race among technology suppliers to define how AI agents should operate inside corporate systems. If Amiga's forecast holds — agent traffic overtaking human traffic in enterprise browsers — the tools that decide what agents can see, do and record become core infrastructure, not an add-on.