The device proxy
The OS level control point every AI conversation flows through.
Updated June 2026
The device proxy is the checkpoint AI traffic on a managed device flows through. It is a native background service on macOS and Windows that captures traffic through the operating system's proxy path, so browsers, desktop apps that honour the system proxy, coding tools, and API calls pass one inspection point. It works entirely at the network layer. There is no browser extension, no page script, and no per-provider hack to fall out of date.
What it decrypts, and what it refuses to
The proxy opens traffic only when there is positive evidence the destination is AI. That evidence is the AI destination registry: a list of a thousand-plus AI sites and apps, derived from the Microsoft Purview supported-AI list and served from the control plane, covering ChatGPT, Claude, Gemini, Perplexity, DeepSeek, Grok, and the rest of the list as Microsoft maintains it. The agent refreshes the registry every thirty minutes and validates each snapshot on the device before it activates, including a floor of one thousand entries, so a bad refresh cannot wipe coverage. Nobody at the firm maintains any of it.
Alongside the registry, process attribution resolves which application opened each connection. That is how AI agents and desktop apps are identified on the record, and how known certificate-pinned desktop apps are recognized and passed through untouched rather than broken.
A destination the proxy cannot positively identify as AI is tunnelled through untouched, and a new AI tool is covered as soon as the registry lists it. Microsoft sign-in and identity traffic is never touched; coverage of Microsoft AI surfaces follows the registry.
Some categories are never inspected at all, as a hard override that runs before any AI check: banking, healthcare, government, sign-in pages such as login.microsoftonline.com, operating-system telemetry, and a floor of popular consumer sites. The same exclusions are written into the certificate itself as X.509 name constraints, so an auditor can read the bounds in the artifact the firm trusts. Firefox and other NSS-based software enforce those constraints cryptographically; macOS does not reliably enforce name constraints on user-added roots, so the runtime gate in the agent is the operating control and the constraints are defence in depth.
Never blocking is structural
The proxy is designed so it can never become the reason a site fails to load.
| Situation | Behaviour |
|---|---|
| The trust certificate is missing or not yet approved | Everything passes through untouched; the operator is alerted, the employee notices nothing |
| A site pins its certificates | Known pinned surfaces sit on the never-inspect list and known pinned desktop apps are passed through by process; a host that fails at origin after interception drops to a direct tunnel for five minutes, with a content-free compliance event on the record |
| A destination has no AI evidence | Tunnelled blind, never opened |
| The agent is paused | The system proxy setting is removed entirely |
| Anything else goes wrong | Every gate fails to passthrough, never to blocking |
Faithful on the wire
Outbound connections match the client that made them. A request carrying Chromium browser markers is forwarded with the pinned Chromium TLS, HTTP/2, and header-order profile that bot-detection edges expect, and every other client is forwarded through a neutral client that preserves its headers and semantics. A site that profiles clients sees a normal browser where a browser was talking, which keeps inspection from degrading the employee's experience.
What inspection produces
When a prompt does pass through, the proxy holds it for classification and redaction before it continues to the AI provider (covered in Redaction and tokenization), stamps the event with the resolved employee identity, and writes it to the signed record. QUIC and HTTP/3 are turned off by managed browser policy (Chrome, Edge, and Firefox on macOS; Edge today on Windows), so AI traffic arrives over TCP where the proxy can inspect it, and the agent's pause control removes the system proxy cleanly for the duration.
Scope notes
Coverage today is browsers and anything else that honours the operating system's proxy settings, which in practice is most software with a UI. Desktop apps that pin their certificates are passed through and recorded as such, and terminal-only CLI tools that ignore system proxy settings are not captured. Each device reports its capture mode, so degraded coverage is visible rather than silent. Inspection of employee AI use is disclosed to employees as part of the firm's deployment, and the never-inspected categories above are part of that supervision posture.
The hosts the agent itself talks to are listed in Network endpoints, and running alongside an existing corporate proxy or security stack is covered in Coexistence.