A capability is something an automation session can do on a system, such as taking a screenshot, running a command or writing a file. There are 18. This page lists them all, marks the risky ones, and shows which ones common tasks need.
Who decides what a key can do
A capability policy decides, for each capability, whether an API key may use it: Allowed, Guardian, Human approval or Denied. You attach a policy to the key's access rules. To choose a built-in policy or create your own, see Create and use capability policies.
The 18 capabilities
Read-only capabilities only look at the system. They're the ones the Read only policy allows.
Capability | What it allows | Risky | Read-only |
| Read the remote clipboard | No | Yes |
| Write the remote clipboard | Yes | No |
| Read files | No | Yes |
| Write files | Yes | No |
| Send key presses and text | No | No |
| Move, click and scroll the mouse | No | No |
| List and read processes | No | Yes |
| Take screenshots | No | Yes |
| Record a task on the system | Yes | No |
| Run a shell command and wait for it | Yes | No |
| Start a process without waiting | Yes | No |
| List installed applications | No | Yes |
| Sign in, sign out, lock and unlock the desktop | Yes | No |
| Read the system's details: OS, displays, windows, session state | No | Yes |
| Show a short message on the person's screen | No | Yes |
| Read on-screen controls by name | No | Yes |
| Focus, minimise, maximise and close windows | No | No |
| List open windows | No | Yes |
The 6 risky capabilities
clipboard.write, file.write, session.record, shell.exec, shell.spawn and system.auth. Between them they cover writing to the system, running code on it, controlling who's signed in, and recording it.
NOTE: Screenshots, the keyboard and the mouse aren't risky, so Approval for risky still lets an agent see the screen and use the mouse and keyboard freely. If you want those reviewed too, create your own policy.
Tell the person at the desk what's happening
ui.notify shows a short line on the system's screen, so someone watching knows what the agent is doing. Leave it allowed on any machine a person uses. A mouse moving on its own is alarming; a line reading Installing the printer driver isn't.
Check what a session can do
hv capabilities check: what the current session is allowed, what needs approval, and what's denied.hv capabilities list: every capability.
Choose only what the task needs
Screenshot audit:
screen.read,system.infoSoftware inventory:
system.apps,system.infoHealth check:
system.info,process.read,window.readTesting a desktop app:
screen.read,ui.read,input.keyboard,input.mouse,window.read,window.controlInstalling software: the above plus
shell.exec(risky)Deploying a file:
file.write(risky)
The first four need nothing risky, so they're safe to run without approval.