Desktop Agent Permissions Are a Responsibility Design Problem

A desktop agent that reads files, drives a browser, and operates local applications crosses boundaries that traditional app permissions isolate. Camera access asks whether an app may use one sensor. Agent access must ask for which task, over which resources, for how long, and with which actions.

Anthropic's computer-use guidance and OpenAI's computer-using agent materials both emphasize isolation, restricted access, and human control over high-impact actions. These are not temporary caveats. A model that interprets interfaces can also be misled by content inside those interfaces.

Permissions should bind to a task. A user can allow reading three files for a report without granting permanent disk access. Least privilege must become least intent: access to a resource does not authorize using it for an unrelated goal or sending it to another service.

Action classes need different thresholds. Reading, drafting, modifying, sending, paying, and deleting are not equivalent. Reversible work can move automatically; irreversible work should present the precise object and consequence. 'Continue?' is not meaningful consent.

Duration and rollback complete the model. Temporary grants expire with the task, persistent connections remain visible, and changes retain logs and undo paths. Permission is not complete until access is withdrawn after the job. Convenience should not silently become a permanent attack surface.

Good permission UX also limits fatigue. A batch of low-risk actions can be previewed and approved within a boundary, with new prompts only when the agent crosses it. More dialogs do not guarantee safety; they often train users to click reflexively.

Enterprise systems must layer organizational policy over personal choice. Administrators define forbidden data domains, approved connectors, and audit requirements; users still authorize the task. When a policy blocks execution, the interface should explain why instead of allowing repeated failed attempts.

A desktop agent earns trust when actions remain aligned with current intent. Permission design is responsibility design. The products that make scope legible, consequences predictable, and recovery possible will be allowed to stay on the machine.