Contain browser agents with domain allowlists, download policy, credential vaults, and screenshot redaction.
