Local category baseline
The category source is versioned so decisions are reproducible and reviewable.
Domain and category policy
Filtering that works without decrypting HTTPS page content
BusinessProxy evaluates the domain, a local versioned category baseline and workspace allow/deny rules before managed browser traffic leaves through an approved route.
The browser-proxy path does not decrypt HTTPS content, inspect page DOM or classify private form fields. Decisions are made on host/category policy.
Domain and host metadataVersioned local category feedWorkspace allow/deny overridesNo TLS content inspection
Decision inputs
Policy is decided before traffic exits
The gateway applies domain/category rules and workspace overrides before routing the browser request through an approved egress location.
Workspace overrides
Admins can adapt the baseline with allow and deny rules that match their environment.
Routing context
Routing mode and selected egress region remain part of the policy context.
Blocked experience
A blocked click should explain the policy
When a user clicks a phishing or disallowed work link, the block page should say what was blocked and which policy class made the decision, without exposing internal rule internals.
- Use clear category names for user-facing blocks.
- Keep admin overrides auditable.
- External threat-feed lookups run only when enabled for that customer.
Current boundary
Host/category filtering, not HTTPS inspection
BusinessProxy does not decrypt HTTPS page bodies on the browser path and does not provide DLP classification. If a page is allowed by domain/category policy, its encrypted content stays encrypted through the proxy path.
- No TLS MITM on the browser path.
- No DOM or form-content inspection.
- This is not full DLP or content classification.
Next step
Review the rollout details before turning it on
The documentation page shows what to configure, how to verify the setup and which operational boundaries to review before rollout.