How to Use Nemotron 3 Content Safety with a Signed-In Browser

Use Tabbit CLI first to read two authorized browser pages in separate task tabs, match the same record by its stable ID, and save only the approved text excerpts. Then send each excerpt as a separate classification request to Nemotron 3 Content Safety. The classifier returns safety labels; it does not plan or control browser steps. Keep the labels beside a named draft and ask a person to review the draft against both source pages before taking action.

This separation fits the model NVIDIA actually documents. The NGC model card describes a 4B multimodal classifier. It returns a required User Safety label (safe or unsafe), and can optionally return Response Safety and safety categories. NVIDIA's technical blog describes the same model as a content-safety step in a broader agent stack. Neither source describes it as a browser-control agent.

Key takeaways

• Use Tabbit to read the two pages. Use Nemotron 3 Content Safety for a separate label step.

• Match records by a stable ID and retain each source URL with the excerpt.

• Send the classifier only the authorized text needed for its task. Do not include unrelated page content or secrets.

• Treat safe and unsafe as model labels, not permission to publish, block, or edit a page.

• Keep browser access, classification, and the human review checkpoint in separate steps.

Verify the model and its access path

NVIDIA NGC currently lists Nemotron 3 Content Safety as a 4B model based on Gemma 3 4B IT, trained for multimodal and multilingual safety moderation. Its card says it is ready for commercial use, subject to the NVIDIA Nemotron Open Model License and the listed Gemma terms. NGC asks users to sign in to access all model content and download it. Hugging Face's public model page documents Transformers, vLLM, and SGLang paths. Confirm your current access and deployment environment before choosing one.

The third-party models.dev entry also lists text input/output and no tool support. Treat that directory as a secondary capability check. The NVIDIA model card remains the source for labels, access and terms. Do not assume a hosted provider exposes this exact model just because it appears in a directory.

Read two pages before classification

Start with the local agent and browser. Install the Tabbit skill in the client, check that the CLI reaches the intended Tabbit profile, then confirm that the target site is signed in. These are separate checks. In Pi, the skill command is /skill:tabbit; clients with a skills picker can select the installed tabbit skill. The Tabbit CLI quick start covers installation.

Ask Tabbit to open only the two authorized URLs in new task tabs. Read one record from each page by its stable ID. Return the visible excerpt, record ID, page title, and source URL. Keep the task read-only. If the record ID is absent, the page asks for sign-in, or the two records do not match, stop and resolve that before classification.

Install Tabbit Browser on the machine running Tabbit CLI. The two task tabs can reuse your existing site session while you work in other tabs.

Use the installed tabbit skill and local Tabbit CLI.
In separate task tabs, open only these two authorized pages:
- [first exact URL]
- [second exact URL]
On each page, find the visible record with stable ID [record ID].
Return only the minimum text excerpt I authorized, the ID, page title, and source URL.
Do not click buttons, submit forms, download files, or change either page.
If a page needs sign-in or either ID is missing, stop and report it.
Save the result as a draft named "Safety review - [record ID]".

Replace the example fields with pages you are allowed to read. Do not pass passwords, cookies, tokens, personal data, or full page dumps to either model. For task setup, see the Tabbit CLI complete guide and the first browser-agent task checklist.

Send each excerpt to the classifier

Once a person has checked the excerpts and their source links, make one classifier request per record. Keep the record ID in your wrapper so the label cannot be attached to the wrong page. The model request receives the excerpt only; it does not receive the Tabbit CLI, browser URLs, or a browser tool.

{
  "model": "nvidia/Nemotron-3-Content-Safety",
  "messages": [
    {
      "role": "user",
      "content": [
        {
          "type": "text",
          "text": "[approved excerpt]"
        }
      ]
    }
  ],
  "max_tokens": 100
}

The model card documents a text response with User Safety: safe or User Safety: unsafe; Safety Categories is optional. It documents Response Safety when a response is included. This request follows NVIDIA’s vLLM example. Keep the record ID and URL outside the request. Validate the classifier's output in your own inference wrapper. The shape below is an illustrative fixture, not a model result:

Record ID: CASE-104
User Safety: safe
Safety Categories: [omitted when none are returned]

Do not interpret a safe result as proof that a page is truthful or that its content can be shared. Likewise, unsafe is a label to inspect against policy and context, not an automatic reason to delete or alter the source.

Keep the label beside its evidence

The workflow should preserve where each excerpt came from and which record it describes. A separate local draft is enough; the classifier does not need to write back to either page.

This is a content-labeling workflow, not a browser automation recipe for the classifier. A moderator on r/AskModerators said borderline filters need a person to “check out and approve or delete” the match. In a separate discussion about invoice flags, an r/AI_Agents commenter advised separating data-quality checks from risk judgments. These are workflow observations from other domains, not tests of Nemotron 3 Content Safety. They support keeping labels distinct from actions.

Choose a separate local boundary for each step

For local inference, NVIDIA's model card and Hugging Face document serving examples. The Hugging Face page shows a vLLM command for the exact model identifier:

vllm serve "nvidia/Nemotron-3-Content-Safety"

Treat this as documented setup guidance, not a test performed for this article. Check the model's license, account access, hardware, and current vLLM version first. If you use a hosted route instead, verify that the provider currently exposes this exact checkpoint and returns the documented labels.

For the browser portion, see connecting an agent to an existing browser, the Codex and Tabbit CLI setup check, and the difference between browser MCP and CLI. The browser-agent prompt template can help make the read scope explicit. For source preservation, see browser research with sources; for later data entry, compare the browser-to-CSV workflow and Excel-to-web-form workflow. If the reviewed output becomes a publishing task, use a CMS draft workflow and keep approval separate.

Use Tabbit to gather only the two authorized excerpts, Nemotron 3 Content Safety to label each excerpt, and a person to review the named draft alongside both source pages. That division keeps browser control out of the classifier and leaves the final decision with the page owner.

Secholar.L

Growth & Content at Tabbit

Secholar.L writes hands-on guides about AI browsers and agent workflows, comparing tools with real research and citing verifiable sources.