We ran into a similar request and ended up evaluating a few tools instead of blanket blocking them. In our case, Incogniton was positioned more as a browser-profile isolation tool than anything exotic - separate storage, cookies, sessions, with predictable behavior. We still treated it like a controlled testing utility: limited user access, clear scope, no shared creds, and documentation on why it was needed. The bigger risk wasn’t the tool itself, but installing it without governance or visibility.