ADMINDecide who can use each computer#
Agent enrollment, a user's permissions and approval for one task are different decisions. Online does not mean that every user may operate the computer's screen.
An ordinary task with approval
The assistant identifies the computer, user session, goal and allowed actions. Review them before approval. A task has limits; a changed goal or scope needs another decision. Approval does not authorise unrelated data access.
Permanent Full Control on selected PCs
agent.full_desktop.unrestricted permits control of applicable computers without approval for every task. It can be scoped to specific PCs. The current code grants it to the built-in system administrator by default; other roles need an explicit grant. It is broader than a one-task approval.
Absolute Access is broader still
core.access.absolute covers all available YAADMIN actions and can override ordinary tool restrictions and confirmations. It is off by default, including for administrators. It is separately configured and is not the same as Full Control over selected Agents.
Grant ordinary working access#
- Open Roles and choose the worker's role.
- Allow the required information or Agent actions.
- Check target-computer restrictions where configured.
- Test as a user with that role, not only as an administrator.
Do not enable Absolute Access merely to remove one tool error; check the narrow permission first.
What broad access cannot do#
It cannot create a missing connection, replace a licence, bypass Windows secure desktop or UAC, or provide external passwords. Revocation stops subsequent checked actions but does not undo completed changes.
If the result is uncertain#
Do not automatically repeat the action. Refresh the screen or check the external system. Stop or disconnection does not guarantee that the earlier operation was cancelled.