- Overview
- Quickstart
- Trust and compliance
- Security overview
- Data security and compliance
- Governance
- Features
- Cartographer
- Delegate for Testing
- Reference
- Troubleshooting
Authorization and restriction controls in Delegate, including security modes, for teams evaluating Delegate before deployment.
UiPath Delegate is an AI assistant that runs on your work computer. You ask it to do things in plain language, such as "summarize this report" or "update the spreadsheet," and it carries the task out across the applications and systems you already use.
To be useful, Delegate acts on your behalf. Evaluating its security comes down to two questions: how do you stay in control of what it does, and how does it reach your system? This page answers the first question and summarizes the second. See Data security and compliance for the full data-handling and network detail behind these claims.
In short
- To do its work, Delegate sends the content a task needs, including screenshots, to a large language model. Every request passes through the UiPath AI Trust Layer: the connection is encrypted and authenticated service-to-service, and a contractual ban prohibits training with your data. You can also bring your own model, including one hosted locally, in which case the entire data flow stays under your control.
- You control Delegate in two complementary ways: authorization (it asks before acting) and restriction (hard limits it cannot cross). Delegate does both.
- Every control described on this page and in Governance with Automation Ops can be enforced and locked centrally through UiPath Automation Ops.
- As an individual user, you configure your own approval mode, screen context, execution mode, and the rest of your local security settings — see Local security configuration.
Two kinds of control
| Control | What it means | Where it is configured |
|---|---|---|
| Authorization | What approval mode governs. It asks before acting, and can be set per operation (Allow, Ask, Block). Keeps a person in control of when Delegate acts. | Local security configuration, or centrally through Governance with Automation Ops |
| Restriction | Independent of any approval: the operating-system sandbox, blocked paths, blocked apps and sites, disabled tools, credential protection, and automatic redaction. Guarantees that certain things never happen at all. | Local security configuration, or centrally through Governance with Automation Ops |
Authorization keeps a person in control of when Delegate acts. Restriction guarantees that certain things never happen at all. Using both together is what makes a regulated deployment safe.
Approval mode
The most important authorization control is approval mode. It sets how much Delegate does on its own versus how often it asks you first, and applies to all chats.
| Mode | Runs automatically | Asks your approval for |
|---|---|---|
| Cautious | Nothing | Every operation |
| Balanced (recommended) | Read-only actions (read a file, view the screen, list emails) | Any write, change, or execute action, plus any action Delegate judges to be irreversible or high impact (for example, submitting a loan application or making a payment) |
| Autonomous | Everything | Nothing (not recommended outside trusted, thoroughly tested environments) |
In Balanced mode, reading is free but any change is gated, and Delegate asks you whenever an action looks irreversible. Entering a password is always an explicit, one-time approval, in every mode.
Approval mode sets the default for the granular, per-tool, per-file, and per-app/site controls in Security settings reference — you can override individual entries there regardless of which mode you have selected. See Approval mode in Local security configuration for the full breakdown.
Settings storage model
Delegate uses a two-layer security model that separates user-configurable settings from protected permissions:
Layer 1: User-accessible settings (settings.json)
Stored as plain JSON in your user data directory:
- Location:
~/Library/Application Support/UiPath/Delegate/settings.json(macOS) - Contents: Appearance, model selection, keyboard shortcuts, execution mode, MCP server configurations, behavior preferences
- Access: You can read and modify directly; changes take effect immediately
Layer 2: Protected security settings (secure-settings.enc)
Stored encrypted using OS-level security:
- Location: Same directory, encrypted file
- Encryption: macOS Keychain or Windows DPAPI (Data Protection API)
- Contents: Tool category permissions, execution policy, authentication tokens
- Access: Only modifiable through the Delegate Settings UI — agents cannot modify their own permissions
Why this separation matters: This design prevents a compromised agent or malicious skill from escalating its own permissions. Even if an agent could modify settings.json, it cannot access or change the encrypted security settings.
Computer use: driving applications like a person
For applications without an API, Delegate works the way a person would, by looking at the screen and moving the mouse and keyboard. This capability, UiPath Computer Use, is built on the same automation technology that powers UiPath Studio and Robots.
- Scope: Delegate acts on the screen and on processes started by your user account, within your own session. Its reach is as broad as your own.
- Privilege boundary: Delegate runs as the signed-in user, without elevated privileges. On Windows, running normally (the default) means Delegate cannot drive applications launched as administrator, because Windows isolates higher-privilege windows from a normal-privilege process — run Delegate without elevation in regulated environments. On macOS, access to the screen, windows, and input is gated by the TCC permissions (Screen Recording, Accessibility, Automation) that you or your organization's MDM grants, and Delegate cannot cross the Unix user boundary to processes owned by another user or root.
- Screenshots: By default, Delegate captures only the application it is attached to, not your entire desktop. Screenshots are sent only to the model to perform the task, and are never included in product analytics, crash reports, or diagnostics.
Two per-conversation dials give you further control: screen context (what Delegate can see) and execution mode (whether it takes over your screen or works without touching it). See Computer use settings in Local security configuration.
You can also tune how often Delegate asks before acting on applications and sites, and block specific destinations or entire sensitive categories outright — see UI automation in Security settings reference.
Scripting and code execution
When a task needs it, Delegate can run commands. A command can do anything the signed-in user can do, so this pathway has the strongest controls.
- Sandboxed by default: Code execution runs inside a kernel-enforced container (Windows AppContainer, or macOS Seatbelt), which confines the filesystem, network, and process access, and walls off credentials such as SSH keys, cloud credentials, and keychains.
- Your choice, by mode: The strictness of the sandbox follows approval mode, and it can be turned off entirely in Autonomous mode — not recommended outside trusted, thoroughly tested environments.
See Terminal and files in Security settings reference for the full configuration options.