Desktop AI Agents & Permissions

How a desktop agent works

1. Index — with read permission, the agent builds a lightweight map of your files: names, types, dates, sometimes embeddings of content.
2. Plan — the model turns your request ("organize my downloads") into concrete steps: group PDFs → move to Documents; group images → move to Pictures.
3. Act — each step becomes a real OS API call (move, rename, create). This is the dangerous part, which is why it should be separately permissioned.

Why permission prompts matter

An LLM plan is a guess, not a guarantee. Permissions convert "the model decided to" into "the model asked and I allowed." Gemini Spark's design — explicit consent before touching local files or Workspace docs — mirrors macOS's own TCC prompts (camera, Documents folder, screen recording). Rule of thumb: read access is recoverable; write access is not. A bad read leaks data; a bad write destroys it.

Sandboxing, in plain words

A sandbox is a fence around a program: it can only see and touch what's inside the fence. Desktop agents get a fence with gates — each permission you flip on opens one gate. Good agent design keeps the model itself inside the sandbox and routes every file operation through a narrow, auditable API, so even a confused or manipulated model can't do more than its gates allow.

Sensible safety defaults

• Dry-run first: show the plan ("will move 14 files") before executing.
• Review before delete: destructive ops go to Trash, never hard-delete.
• Least privilege: grant only the folders a task needs, not the whole disk.
• Audit log: every action recorded, every action undoable.
• Human-in-the-loop for anything that leaves the machine (uploads, sharing, email).