Fine-grained local security controls in Delegate and Cartographer — tool permissions, terminal and files, protected files, and UI automation — that extend beyond Approval mode.

These settings live under Settings → Security, organized into four areas: Tool permissions, Terminal and files, Protected files, and UI automation.

Configure when Delegate needs your approval. Tools are organized into four top-level categories, each showing how many tools or operations it covers:

Expanding a category breaks it down further. System tools, for example, splits into four groups:

Each group can be set independently to Allow (run automatically), Ask (prompt first), or Block (deny automatically), and expands further to set individual operations on their own.

Connectors and Office follow the same read-only vs. write-and-modify principle at their own scale: each app or service (Outlook, Slack, Excel, and so on) breaks down into its own operations, generally split the same way — for example, reading a Slack channel or an Excel range is read-only, while posting a message or writing to a range is write — each set to Allow, Ask, or Block the same way as System tools.

MCP servers are handled the same way as the other categories, except the operations available depend entirely on which servers your organization has configured.

Delegate can run shell commands and scripts through the Shell command sandbox, currently in BETA: a scope-aware sandbox manager using Windows AppContainer for kernel-level file system, network, process, and credential isolation. See Scripting and code execution in Security overview for how the sandbox works conceptually.

A toggle that turns the sandbox on or off for shell commands. When off, commands run with full user rights instead of the confined environment described in Security overview.

Shell commands can access only the paths listed here; everything else is blocked. Add your own paths beyond the defaults.

Additional capabilities you can grant to sandboxed shell commands, since they're outside what the sandbox allows by default. Internet access, Private network, and Removable storage are off by default; Shell profile is on by default:

Changes to these may require restarting the app to take effect.

Block specific types of commands from running — click a suggestion to add it, or type a custom pattern (for example, shutdown, format c:, netstat). These patterns are checked before execution: the agent's command is matched against them as regex and blocked before it runs. This is a separate mechanism from Kernel isolation, and applies regardless of whether the sandbox is on.

Delegate needs approval before accessing these files, grouped into categories by what they protect:

You can add your own custom path or pattern beyond these.

Use case: Catch files that might contain credentials, cryptographic material, cloud account access, or other sensitive data, without having to enumerate every possible location yourself.

Controls which applications and websites Delegate can act on without asking, and which it must never touch.

Use case: Pre-approve trusted workflows (such as Microsoft Excel, Microsoft Word, or an internal site) so they do not trigger repeated confirmation prompts, and block specific applications or sites, or entire sensitive categories, so the agent can never read or act on them.

See Permission setting best practices for recommendations by role — individual users, IT administrators, and developers creating skills.