Centralized enforcement of Delegate's security controls through UiPath Automation Ops, including policy targeting and the recommended baseline for regulated environments.

None of the security controls described in Local security configuration are only a personal setting that users must be trusted with. All of them can be managed centrally through UiPath Automation Ops, the same governance plane you already use for the rest of your UiPath estate.

Prerequisites:

To create and deploy a governance policy for Delegate, take the following steps:

Result: The policy applies to the target you configured — user, group, or tenant — the next time the app starts or a new conversation begins. If more than one policy targets the same user, the most specific one wins. Changes can take up to 30 minutes to propagate. Settings enforced this way are re-applied from the live policy every time, and are never stored as the user's own choice.

What each policy tab controls:

Enables or disables individual tools by category, and sets path, command, site, and application restrictions centrally — the same controls described in Terminal and files, Protected files, and UI automation in Security settings reference, applied at the policy level instead of locally.

Allows or blocks Delegate's ability to delegate work to a helper agent, for everyone the policy targets.

Controls whether users can add their own MCP servers, and lets you provision remote MCP servers automatically for everyone in the policy group — users connect to these without any setup of their own and cannot remove them. Provisioned servers must be remote (HTTP/SSE) endpoints; local servers can't be centrally provisioned this way. See Connecting tools for how MCP servers work day to day.

Locks Approval Mode and screen context mode so users can't change them locally, and lets you prepend organization-wide custom instructions to every conversation on top of whatever the user adds themselves. See Local security configuration for what these controls look like from the user's side.

Sets Allow, Ask, or Block for every individual tool and connector operation — the granular controls described in Tool permissions in Security settings reference, applied at the policy level. Reading and writing are controlled separately: reading an inbox and sending an email, or reading a spreadsheet and deleting a sheet, are each their own operation. By default, read operations run automatically and write operations ask first — for example, you can set Outlook's delete operation to Block, so Delegate can read and send mail but can never delete it.

Selects the default model and which models are available to users. See Choosing the LLM model.

Allows or blocks context grounding knowledge — organization knowledge bases and document indexes used for grounded responses. See Context grounding indexes in Settings reference.

Keep the powerful pathways available but tightly controlled, rather than switching them off. All of the following can be enforced centrally through Automation Ops:

Confirm the exact baseline with your UiPath team against your specific compliance requirements.

Set Approval Mode to Cautious and lock it, run Delegate without administrator privileges, keep the strict sandbox on for scripting and grant only the folders it needs, enforce blocked sites and applications using the built-in catalog as a start, set destructive operations such as deletion to Reject, store credentials in UiPath Orchestrator, pre-approve only applications and sites you have vetted, leave MCP off, and use local-only conversation storage if chat history must stay on the device. See the baseline checklist above for the full list.

In a trusted test environment with no production data and no real credentials, you can relax the controls to evaluate the full range of capabilities. Balanced mode is a sensible default for testing, and Autonomous mode can be used to explore scripting and automation freely. Keep real secrets and production systems out of that environment, and apply the baseline above before you move to production.