Field note
Gemini Chrome Agent: Approval Checklist
Gemini in Chrome can read your open tabs, reach into Workspace pages and browse on your behalf, so decide what it may see and what it may submit before anyone at work switches it on.
Gemini in Chrome can read your open tabs, reach into Workspace pages and browse on your behalf, so decide what it may see and what it may submit before anyone at work switches it on.
What Gemini in Chrome can do
Gemini in Chrome sits in a side panel of the desktop browser. According to Google's help pages, it uses the content of your current tab by default, and you can share up to 10 open tabs with it. Tabs opened from a chat or from a shared tab are also shared. You can type @ to add a tab to a prompt, and you can go Live and talk while you browse.
The help page lists what it can do, including "complete multi-step actions on your behalf" and "draft messages to send to others using Gmail". There is a browser permission called "Let Gemini browse for you" that enables automatic browsing. If you share a Workspace page such as a Google Doc, Gemini may access your Workspace account directly to read the whole document rather than only what is visible in the tab.
It needs a signed-in Chrome profile, does not work in Incognito mode, and for a work or school account it must be enabled by the Workspace administrator. Google's privacy notice is unusually direct: "Supervise Gemini's web browsing and tasks closely and interrupt if needed", and it warns that Gemini can make mistakes "like making purchases or sharing your data with third parties unexpectedly".
Where the risk is
Reading. Gemini collects the page content and URL from the current tab and any shared tabs. Google notes that "some of the page content Gemini uses might not be visible to you". Hidden text on a web page is a prompt-injection route. Signed-in sessions are also just tabs: a CRM, online banking, the payroll portal and an admin console are all readable if they are open and shared.
Acting. Automatic browsing can navigate and fill in forms. A submitted form is an external effect: an order, a message, an account change, an upload. A person cannot undo a sent message by closing the panel.
Retention. With Keep Activity on, information from websites you visit with the feature, and audio and files you share with it, are stored in Gemini Apps Activity. Page content is logged to the account temporarily. On a personal Google account that activity can be reviewed and used to improve Google services depending on the user's settings. On a Workspace account the Workspace privacy terms apply instead, and the administrator controls retention.
The control pattern
- Decide the account type first. A personal Google account signed into a work laptop's Chrome profile is the largest gap, because the business has no administrative control over it. Work use should run on a work account, where the administrator can turn the Gemini app on or off.
- Turn off "Share current tab by default" in Chrome settings for anyone who works in sensitive systems. Share tabs deliberately with "Add tabs" and remove them with "Remove tab" when done.
- Leave "Let Gemini browse for you" off until a task has been approved. Approve by class of task: research on public sites is low risk; anything behind a login needs a named approver.
- Require a human checkpoint before any submit. The person must be at the screen, and must press the button or confirm the action themselves for messages, purchases, account changes and uploads.
- Use a separate Chrome profile for agent work, with no saved passwords for finance, HR or customer systems.
- Before rollout, test with a page that contains hidden instructions and check whether Gemini's behaviour changes. If it does, that is your evidence for keeping automatic browsing off.
The same shape of checklist for a different vendor is in ChatGPT agent browser safety, and the access-matrix approach is in the agentic AI security checklist for SMEs.
What to write into policy
- Gemini in Chrome may only be used on a work Google account that the administrator has enabled.
- A list of sites that are never shared: banking, payroll, HR, customer records, admin consoles.
- Automatic browsing is off by default. Approved tasks are listed with an owner.
- Every submit, purchase, message or account change is confirmed by the person, not the agent.
- Incident route: stop the task, remove the shared tabs, review Gemini Apps Activity, tell the named owner, and report the problem to Google if the behaviour was unexpected.
When to escalate to the admin or Google
If the feature is missing, Google's own troubleshooting says to check with your system administrator that it has not been disabled by the organisation, to confirm you are in a supported region, and to turn off a VPN that may make the location look unsupported. To report a problem, open More, then Settings and help, then Send feedback in the side panel. A response that raises a legal issue can be reported under the response itself.