From 708303657ab2d7cf4c61b37f1b2665d0a82b9488 Mon Sep 17 00:00:00 2001
From: dprevoznik <58714078+dprevoznik@users.noreply.github.com>
Date: Wed, 29 Jul 2026 00:43:47 +0000
Subject: [PATCH 1/2] docs(browsers): add chrome policy use case for blocking
 DevTools

---
 browsers/pools/policy-json.mdx | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/browsers/pools/policy-json.mdx b/browsers/pools/policy-json.mdx
index 1332c80..ee0b356 100644
--- a/browsers/pools/policy-json.mdx
+++ b/browsers/pools/policy-json.mdx
@@ -240,6 +240,40 @@ const browser = await kernel.browsers.create({
 ```
 </CodeGroup>
 
+### Block DevTools and page source
+
+DevTools hands anyone who can reach a browser a console on the page, plus network logs, cookies, and local storage. When you expose a session through live view, or run agent code you don't fully trust, block the URLs DevTools loads from:
+
+<CodeGroup>
+```python Python
+from kernel import Kernel
+
+kernel = Kernel()
+
+browser = kernel.browsers.create(
+    chrome_policy={
+        "URLBlocklist": ["devtools://*", "chrome://inspect", "view-source:*"],
+    }
+)
+```
+
+```typescript Typescript/Javascript
+import Kernel from '@onkernel/sdk';
+
+const kernel = new Kernel();
+
+const browser = await kernel.browsers.create({
+  chrome_policy: {
+    URLBlocklist: ["devtools://*", "chrome://inspect", "view-source:*"],
+  },
+});
+```
+</CodeGroup>
+
+Pressing **F12** or choosing **Inspect** now shows "Your organization has blocked the use of DevTools on this page", and navigating to a blocked URL fails with `ERR_BLOCKED_BY_ADMINISTRATOR`. Other `chrome://` pages keep working, so add `chrome://net-export` and `chrome://net-internals` to the list if you also want to close off network capture.
+
+Chrome's dedicated policies for this — `DeveloperToolsAvailability`, `DeveloperToolsDisabled`, and `RemoteDebuggingAllowed` — are rejected by the API, because Kernel drives your browser over the same DevTools protocol they turn off. `URLBlocklist` only blocks navigation to the DevTools front-end, so your automation keeps working: CDP and Playwright still connect, and `page.content()` still returns page HTML even though `view-source:` is blocked. Treat this as a guardrail on the interactive surface, not as a way to hide page contents from code running in the session.
+
 ## Available policies
 
 Any policy listed in the [Chrome Enterprise policy documentation](https://chromeenterprise.google/policies/) can be used in the `chrome_policy` object. Refer to the official docs for the full list of supported policy names, types, and values.

From ed7884d7f8b135f886dd96fbd83a8ab4b97ccf9e Mon Sep 17 00:00:00 2001
From: dprevoznik <58714078+dprevoznik@users.noreply.github.com>
Date: Wed, 29 Jul 2026 00:47:38 +0000
Subject: [PATCH 2/2] Trim explanatory notes from DevTools policy use case

---
 browsers/pools/policy-json.mdx | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/browsers/pools/policy-json.mdx b/browsers/pools/policy-json.mdx
index ee0b356..834b9a6 100644
--- a/browsers/pools/policy-json.mdx
+++ b/browsers/pools/policy-json.mdx
@@ -270,10 +270,6 @@ const browser = await kernel.browsers.create({
 ```
 </CodeGroup>
 
-Pressing **F12** or choosing **Inspect** now shows "Your organization has blocked the use of DevTools on this page", and navigating to a blocked URL fails with `ERR_BLOCKED_BY_ADMINISTRATOR`. Other `chrome://` pages keep working, so add `chrome://net-export` and `chrome://net-internals` to the list if you also want to close off network capture.
-
-Chrome's dedicated policies for this — `DeveloperToolsAvailability`, `DeveloperToolsDisabled`, and `RemoteDebuggingAllowed` — are rejected by the API, because Kernel drives your browser over the same DevTools protocol they turn off. `URLBlocklist` only blocks navigation to the DevTools front-end, so your automation keeps working: CDP and Playwright still connect, and `page.content()` still returns page HTML even though `view-source:` is blocked. Treat this as a guardrail on the interactive surface, not as a way to hide page contents from code running in the session.
-
 ## Available policies
 
 Any policy listed in the [Chrome Enterprise policy documentation](https://chromeenterprise.google/policies/) can be used in the `chrome_policy` object. Refer to the official docs for the full list of supported policy names, types, and values.