Your settings and your organization's policy

Your organization’s Desktop policy sets the most agents may do on a computer. Your own switches in Settings can turn any of it off for your computer, and decide whether agents work on your computer or in the cloud first.

Two sets of switches decide what agents may do on your computer:

• Your organization’s Desktop policy sets the most that is allowed, for the whole organization and per group.
• Your own switches, in Settings > Shell & files and Computer control, can turn any of it off for this computer, never on beyond the policy.

Agents can do what both allow. The first shell command, file write, browser use or computer control in a conversation still asks you (see the shell, browser control and computer control).

Your switches

Everything starts on. Settings > Shell & files:

Switch	What turning it off does
Files	Read and write, Read only or Off for every trusted folder on this computer. Only the levels your organization allows are offered. Off also turns the shell off.
Shell commands	Agents cannot run commands on this computer.
Shell network	Commands still run, but cannot download packages or call web services. Shown while files and the shell are on.
App automation	Commands cannot drive other apps with AppleScript.
Browser control	Agents cannot use the Omni browser on this computer.
Move work to the cloud	You cannot move a conversation to the cloud from this computer.
Bring work back to this Mac	You cannot bring cloud files back to this computer.

Folders that may be trusted shows your organization’s rule (Any folder, the allowed folders, or None) and cannot be changed. Settings > Computer control holds that switch and its macOS permissions. See Computer control.

Settings > Shell & files, with browser control turned off by the organization. Shown with sample data.

When your organization does not allow something

A switch the policy turns off reads Not allowed, with Your organization does not allow this. Ask an admin. When your organization turns Omni Desktop off for you, the menu bar icon reads Turned off by your organization, the sidebar shows Mac turned off, and agents cannot reach this computer. Policy changes apply while the app runs, with no restart.

Prefer this computer or the cloud

Agents also have a cloud workspace and browser. Two switches in Shell & files decide where they work first in app conversations:

Switch	On (the default)	Off
Prefer this Mac’s files and apps	Agents work on this computer first: your trusted folders, the shell and your apps.	Agents work in the cloud, and use this computer when you ask them to.
Prefer this Mac’s browser	Agents browse in the Omni browser on this computer first.	Agents use the cloud browser, and browse on this computer when you ask them to.

Turn one off to keep agents working after you close the lid, or to keep work off your computer unless you ask.