# Browser extension permission and site review

Compare native manifest fields with a specific approved-host example and the actual grant.

Inert Chrome manifest example using reserved invalid hosts, with no scripts or extension installed.

Source: https://aona.ai/resources/guides/ai-browser-extension-company-data/
Sources checked: 2026-09-21

| State | What it means | Evidence |
| --- | --- | --- |
| Declared | Manifest requests a capability | Current package manifest |
| Granted | Browser or administrator allows it | Effective site-access record |
| Observed | Approved test shows an operation | Scoped synthetic observation |
| Permitted use | Employer approves that data/task | Owner decision |

## Review checklist

- [ ] Review the current manifest fields
  Include host, optional and content-script scopes, not only the displayed product name.
- [ ] Record what access is actually granted
  Keep optional and managed grants separate from declarations.
- [ ] Identify recipients and change ownership
  A host scope does not answer data handling or who can approve its expansion.

## Included example files

- README.md
- manifest.review-only.json
- site-access.csv
- approval.md

## Source references

- Chrome for Developers: Declare permissions: https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.