Developer preview · Linux (X11)

Scope and lease

Consent covers a scope (the apps you picked) for a lease (a limited time).

Scope

An agent can only read and act on the apps you selected. Asking for the whole desktop, or for launching an app, is refused: ask the person to start the app, then request a new scoped consent.

Lease

A host can propose the apps and a session length of 1 to 300 seconds (300 by default) before the session starts.
The lease cannot grow when the host changes its policy, cannot renew itself, and does not move to a new process that reuses an old process id.
When it runs out, the driver answers consent_expired, and a new session needs a new click.
Ending a session clears consent and every element token.

Rate limits

Reads and screen captures have their own limits, so an agent cannot flood an app or the screen.