I have configured squid as kerberized service. The company distributed a browser specific to the proxy server and that was the company browser. This meant that

I have configured squid as kerberized service. The company distributed a browser specific to the proxy server and that was the company browser. This meant that using that browser passed through squid and all the web traffic was cataloged. The browsing could then be annotated and cataloged for the office. It's the kind of thing that takes a while to get configured but after that it is easy to replicate as part of the standard deployment. Anybody could use any browser to do what they want without passing through the proxy server. One browser was configured to use it.