权限设置最佳实践

Recommendations for configuring Delegate and Cartographer permissions securely, by role — individual users, IT administrators, and developers creating skills.

面向个人用户

To configure Delegate and Cartographer securely as an individual user, take the following steps:

1. Start with Cautious mode until you understand what the agent does.
2. Enable only the tool categories you need — if you don't use command execution, disable it.
3. Review tool permissions after installing new skills — skills may request additional capabilities.
4. Use Protected files and Blocked apps/sites for sensitive directories and destinations (tax documents, medical records, etc.).
5. Set Screen context to None when working with confidential visual information.
6. Pin important sessions so you can review what the agent did later.

适用于 IT 管理员

使用 Automation Ops 进行监管包括对所有用户的集中部署和强制执行这些设置，包括为受监管环境建议的基准。

面向创建技能的开发者

要开发遵循良好权限设置实践的技能，请执行以下步骤：

1. Request only the permissions you need — don't ask for UI automation if your skill only reads files.
2. Document required permissions clearly in your skill description. See Sharing skills with your team.
3. Handle permission denials gracefully — explain to users why a permission is needed.
4. Test in all three Approval mode settings to ensure your skill behaves appropriately.
5. Don't rely on being able to reach a site the user or organization has blocked — blocked websites are configured specifically to keep the agent out.