# Security and permissions troubleshooting

> Diagnose and fix Delegate permission denials, failed approvals, and blocked-site or skill-permission issues tied to Security settings.

## Delegate says it doesn't have permission

**Cause 1:** The relevant tool category is disabled.
**Solution 1:** Check [Tool permissions](security-settings.md#tool-permissions) for that category.

**Cause 2:** The app or site is in Blocked apps/websites, or the path matches a Protected files category.
**Solution 2:**
1. Check [UI automation](security-settings.md#ui-automation).
2. Check [Protected files](security-settings.md#protected-files).

**Cause 3:** You're not sure which control is denying it.
**Solution 3:** Switch to Cautious mode temporarily to see the specific denial.

## I approved an action but it still failed

**Cause 1:** The Windows UAC prompt wasn't actually accepted.
**Solution 1:** Confirm it was accepted.

**Cause 2:** On macOS, the screen recording or accessibility permission wasn't granted.
**Solution 2:** Check **Settings** → **Permissions** to confirm it's enabled.

**Cause 3:** The app or site is in Blocked apps/websites, or the path matches Protected files.
**Solution 3:** Check both under [Security settings](security-settings.md).

**Cause 4:** The real issue is unrelated to permissions (network, authentication).
**Solution 4:** Read the full error message before assuming it's a permission problem.

## I want to allow a site that's blocked

**Cause 1:** It's listed individually under Blocked websites.
**Solution 1:** Remove it under [UI automation](security-settings.md#ui-automation).

**Cause 2:** It was added as part of a category (Banking, Payments, Crypto, Password Manager, Government, Healthcare).
**Solution 2:** Remove it from that category under [UI automation](security-settings.md#ui-automation).

**Cause 3:** The setting is locked and shown as managed by your organization.
**Solution 3:** Ask your administrator — it's enforced through Automation Ops and can't be changed locally.

## A skill keeps asking for permissions I already granted

**Cause 1:** It's actually requesting a different permission than before.
**Solution 1:** Check what's being requested this time.

**Cause 2:** The permission is session-scoped.
**Solution 2:** Re-approve it for the new session.