DemoLog inContactDE
Browser Endpoints

Every browser is a signed endpoint. Every cookie is a governance heartbeat.

The Cookie Jar plane deploys the Lojycal extension, pushes browser policy and configuration, and treats every heartbeat as a signed posture write. Removals are detected in under a minute — and can restore themselves automatically.

See the browser planeBook a demo

Why most "managed browser" dashboards go blind

Generic browser management leans on hour-long inventory pulls. Between two pulls a user can uninstall the extension, disable a policy, flip incognito on and reset the profile — the console still paints the tile green. Lojycal treats the browser as an endpoint in its own right: heartbeat-checked, HMAC-verified, WORM-audited, and pushed back to spec automatically the moment the cookie disappears.

The 3-layer browser governance model

Layer 1

Extension deploy + signed heartbeat

The Cookie Jar extension ships MV3 across the Chromium family (Chrome, Edge, Brave, Arc, Opera, Vivaldi) plus Firefox and Tor. Every install self-links to its org via inventory match, then heartbeats an HMAC-verified payload to /api/public/hooks so posture is known within 60 seconds — no anon key, no bearer bounce.

  • • MV3 manifest with narrow host_permissions — only lojycal.com and the tenant preview domain.
  • • Removal is inferred from missed heartbeats via the cookie-jar-watchdog cron (pinned to * * * * *).
  • • UA-based OS and browser redetection re-parses the last stored UA when a row is stuck on stale metadata.
Layer 2

Browser policy + configuration push

Managed browser profiles are pushed through the same MDM bridge that governs Jamf, Intune and Kandji devices. Policy, extension pin, allow-listed origins and homepage config all land as a single signed configuration write — the browser reconfigures itself the moment the cookie lands.

  • • Extension is pinned + force-installed via managed profile; end users cannot silently disable it.
  • • Per-org policy: allowed origins, download restrictions, incognito posture, telemetry off by default.
  • • Blueprint drift is verified daily and any divergence emits an audit event before IT even opens the console.
Layer 3

Cookie Jar removal + restore ledger

When the governance profile is removed from a device the extension goes silent — and Lojycal reacts. The endpoint feed flips red, the AI Threat Lab lights up, IT gets a global toast, the subject gets a nudge, and a row lands in the WORM cookie_jar_events ledger. If auto-restore is enabled, the profile is re-pushed through the MDM bridge without an admin clicking anything.

  • • cookie_jar_events is append-only — restore_at, it_acknowledged_at, nudges_sent, auto_push_status all update on the same immutable row.
  • • Time-to-restore is measured, benchmarked and available as an auditor evidence metric.
  • • Reaper cron clears stuck sync runs so the ledger never wedges after a process crash.

What the browser plane guarantees

Cross-browser by default

One extension image covers Chrome, Edge, Brave, Arc, Opera and Vivaldi through the Chromium web-store pipeline, plus a Gecko build for Firefox and Tor. Safari support ships via the Xcode-signed variant. No browser is a blind spot.

Sub-60s posture detection

Extension heartbeats are ingested through /api/public/hooks with HMAC verification. The cookie-jar-watchdog cron runs every minute and flips missing-heartbeat devices to red so the worst-case detection-to-alert latency is under a minute.

UA-based OS + browser redetection

An authenticated server function re-parses the stored user-agent for any fingerprint and rewrites os, browser and browser_version in place — rows never sit permanently misclassified after a browser upgrade.

Auto-restore via MDM bridge

Cookie Jar policy is an org-level toggle. When on, a profile removal triggers an automatic re-push through the native MDM plane (Jamf, Intune or Kandji) — stamped once per event so the same removal never fires the same push twice.

Secrets stay server-side

Extension tokens are vended only through an admin-only server function; the raw org_agent_tokens.token column has REVOKE SELECT from authenticated. HMAC secrets for the webhook route live in dedicated tables the browser cannot read.

WORM audit ledger

Every removal, restore, IT acknowledgement, nudge and auto-push attempt is recorded on the same immutable cookie_jar_events row — protected by the worm_block_mutation trigger so UPDATE and DELETE are refused, even for platform admins.

Governance on by default

  • Per-org RLS on every browser posture table — no cross-tenant heartbeat reads.
  • AAL2 required for auto-restore and policy toggles when the org sets force_mfa.
  • Webhook ingress HMAC-verified with timing-safe compare — the browser-bundled anon key is never a gate.
  • cookie_jar_events is WORM — UPDATE and DELETE are blocked for everyone, platform admins included.
  • No force-green fallback: cached last-seen state never overrides a missed heartbeat.
  • Every action emits an audit_log row — actor, target, before / after.

The cookie is the contract.

One extension. One heartbeat. One signed ledger. Every managed browser stays in policy — and if it doesn't, Lojycal knows in under a minute and can put the cookie back.

Book a demoIntegration LedgerSee pricingSee Integration Ledger