Permissions and platforms

​

Definition

Permissions describe what an actor or runtime may access. Platform handling describes how Rudder preserves those boundaries on macOS, Linux, and Windows. Neither a prompt nor a selected runtime can grant authority outside the active organization, workspace, deployment mode, and configured capability set.

​

States and modes

A local runtime test reports pass, warn, or fail. Treat a warning as a specific setup condition to inspect, not as proof that every capability is available.

​

Constraints

• Local trusted runtime processes normally use the operator’s HOME and USERPROFILE. Provider-specific config, selected Skills, sessions, and temporary state stay in adapter-managed locations.
• Credentials remain in the path owned by the provider or operator. Do not copy secrets into documentation, prompts, Library files, or Issue comments.
• Rudder selects the Skills exposed to a Run. Stale, disabled, or unrelated Skills must not remain visible because an earlier Run materialized them.
• Required workspace, permission, login, or Skill failures should stop with an actionable error instead of reaching the provider as an unexplained failure.

​

Boundaries

Rudder Desktop’s Built-in Browser keeps one persistent website session per operating-system user and local Rudder instance. Organizations and supported local Agent tabs on that instance share cookies and site data. Tab control is still scoped by organization, Agent, Run, and tab. Agents do not receive raw cookies, passwords, arbitrary JavaScript execution, or another Run’s tab. Cookie import is currently available on macOS for supported local Chrome, Microsoft Edge, and Brave profiles after operator confirmation. It does not import passwords. Windows and Linux cookie import are not supported. On Windows, Rudder may use junctions or safe copies where ordinary directory symlinks would require elevated privileges. Operators should not need to run Rudder as administrator merely to load a selected Skill.

​

Examples

• A local Codex Run can use the operator’s existing Codex login while Rudder keeps its selected Skills and session state in managed locations.
• Turning off Agent Browser access removes the managed control capability but preserves operator tabs and saved website data. Clearing browsing data is the action that removes the shared website session.
• A Windows Skill link returns EPERM. Rudder should use a supported fallback or report which path and permission need repair before provider execution.