# Local security configuration

> Security controls an individual user sets directly from the chatbox — approval mode, screen context, and execution mode — plus OS-level permissions and advanced security settings.

This page covers the security controls you set yourself, as an individual user, starting with the three controls available directly from the chatbox.

## Security checklist

These are the main tasks to configure Delegate locally, in order:

- [ ] Set [approval mode](#approval-mode), [screen context](#screen-context), and [execution mode](#execution-mode) from the chatbox
- [ ] Review [advanced security settings](#advanced-security-settings) — fine-grained Allow/Ask/Block control over tools, terminal and files, protected files, and UI automation
- [ ] Choose your [conversation storage](#conversation-storage) mode
- [ ] Verify [OS-level permissions](#os-level-permissions)
- [ ] Review installed skills' requirements against your setup for compatibility
- [ ] Know how to interrupt or stop Delegate (Escape key)

## Approval mode

Set from the mode selector next to the chatbox, and applies to all chats:

![Approval mode dropdown showing Cautious, Balanced, and Autonomous](https://dev-assets.cms.uipath.com/assets/images/delegate/approval-mode-dropdown-f87bafae.webp)

| Mode | Behavior |
|---|---|
| **Cautious** | Asks for all operations; strict process isolation with allowlist-only access |
| **Balanced** (recommended) | Runs safe tools automatically; asks before high-impact operations; protects credentials and sensitive files |
| **Autonomous** | Full system access, no prompts |

Approval mode sets the defaults for the granular, per-tool, per-file, and per-app/site controls — tool permissions, terminal and files, protected files, and UI automation — described in [Security settings reference](security-settings-reference.md).

## Computer use settings

Screen context and execution mode both govern Delegate's computer use — what it can see, and how it acts on your screen.

### Screen context

Governs what Delegate can **see**. Set from the screen icon next to the chatbox:

![Screen context dropdown showing Default, All apps, and None](https://dev-assets.cms.uipath.com/assets/images/delegate/screen-context-dropdown-ed32a8b4.webp)

| Option | What Delegate sees |
|---|---|
| **Default** | Only the apps attached to the current chat |
| **All apps** | Every visible app |
| **None** | Nothing — Delegate can ask you to turn it on when it needs to |

The chatbox also shows which apps are currently attached to the chat, since Delegate only sees what's listed there when capturing your screen.

#### First message of each turn

A related setting under **Settings** → **General** → **General**:

![First message of each turn sends a full screenshot toggle](https://dev-assets.cms.uipath.com/assets/images/delegate/full-screenshot-first-message-02b40ac7.webp)

In Default mode, each user message gets one full-screen capture so "do this for me" works on cold start. Subsequent turns within the turn mask to attached apps. On by default.

### Execution mode

Governs how Delegate **acts** — whether it takes over your screen or works without touching it. Set from the computer icon next to the chatbox:

![Execution mode dropdown showing Autonomous, Guided, and Offscreen](https://dev-assets.cms.uipath.com/assets/images/delegate/execution-mode-dropdown-73e591bf.webp)

| Mode | Behavior |
|---|---|
| **Autonomous** | Takes over your screen to perform actions; only asks for approval when security policy requires it |
| **Guided** | Takes over your screen to perform actions; asks for your approval before interacting with each app |
| **Offscreen** | Works in its own environment without taking over your screen — you keep working, and it notifies you when it needs input |

Offscreen expands into three sub-modes:

| Sub-mode | Behavior |
|---|---|
| **Local (new session)** | Creates a separate Windows session via RDP (requires setup) |
| **Web only** | Runs browser tasks in a minimized window via CDP — parallel-friendly for browser work |
| **Native Background** | Runs web and desktop tasks together in the background |

A separate **Always plan before** toggle, next to execution mode, has Delegate review its plan with you before executing the task — this may consume more token units.

For Autonomous and Guided mode, where Delegate takes over your screen, two auto-minimize settings keep it out of the way while it works:

| Setting | Default | What it does |
|---|---|---|
| **Enable Auto-Minimize** | On | Minimize the Delegate window during UI automation |
| **Maximize Target App** | On | Bring the target application to full screen during automation |

For the Web only and Native Background sub-modes, you can select which named browser profile to use — this determines which cookies, logins, and extensions are available.

## Advanced security settings

Beyond approval mode, **Settings** → **Security** holds four areas of fine-grained, per-tool, per-file, and per-app/site controls:

| Area | Covers |
|---|---|
| **Tool permissions** | Allow, Ask, or Block for individual tools, connectors, and operations |
| **Terminal and files** | The shell command sandbox, its allowed paths, capabilities, and blocked commands |
| **Protected files** | Files Delegate needs approval to access — secrets, keys, cloud credentials, config, and data files |
| **UI automation** | Trusted and blocked apps and websites |

See [Security settings reference](security-settings-reference.md) for the full breakdown of each.

## Conversation storage

A user-selectable, security-relevant setting that lives outside Settings → Security: **New tasks**, under **Settings** → **General** → **General**.

| Mode | Behavior |
|---|---|
| **Local** | Chat history stays on the device only (SQLite). |
| **Remote** | A PostgreSQL database stores chat session metadata, message content, delegation requests, user settings, daily usage, and product settings. |

Message content, including attachments and screen context screenshots, transits the UiPath backend for inference regardless of storage mode, but is not persisted server-side in Local mode.

## OS-level permissions

Beyond approval mode, screen context, and execution mode, the operating system controls what Delegate can do — and always takes precedence: if macOS or Windows denies a permission, Delegate cannot do that thing regardless of what you have set above.

### macOS permissions

The following table lists the permissions Delegate requires on macOS.

| Permission | Where to Grant | What It Enables |
|------------|----------------|-----------------|
| **Screen Recording** | System Settings → Privacy & Security → Screen Recording | Delegate can see your screen for context |
| **Accessibility** | System Settings → Privacy & Security → Accessibility | Delegate can click, type, and control applications |
| **Files and Folders** | Granted per-folder when first accessed | Reading and writing specific directories |
| **Microphone** | System Settings → Privacy & Security → Microphone | Voice input (optional) |

**To revoke**: Go to the same settings and uncheck Delegate. The app will continue to work but with reduced capabilities.

### Windows permissions

The following table lists the permissions Delegate requires on Windows.

| Permission | Where to Grant | What It Enables |
|------------|----------------|-----------------|
| **UI Automation** | User Account Control during install | Controlling applications |
| **File System** | Standard user permissions | Reading/writing files in accessible locations |
| **Network** | Windows Firewall (if prompted) | Web access, cloud integrations |

:::note
On Windows, running as Administrator grants broader access but is not required for normal operation, and prevents Delegate from driving applications you have launched as administrator.
:::