> ## Documentation Index
> Fetch the complete documentation index at: https://docs.velatir.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> The operating system permissions Velatir for Desktop needs on Windows and macOS, and why

## Overview

Velatir for Desktop needs a small set of operating system permissions to run as a background agent and deliver the browser extension. Everything is requested at install time, and the list is short on purpose: there is no microphone, camera, location, or full-disk access.

## Windows

The installer asks for administrator rights once. It uses them to place the files and register the background service. After that, the [CLI](/desktop-app/cli) asks for elevation only for commands that change configuration or restart the agent.

Velatir then runs as a background service that starts automatically, so it keeps working across reboots without anyone needing to launch it. A tray icon shows when it is running.

| Prompt                     | When                                                  | What it grants                         |
| -------------------------- | ----------------------------------------------------- | -------------------------------------- |
| User Account Control (UAC) | At install                                            | Administrator rights for the installer |
| UAC for some CLI commands  | Running `velatir set-api-key`, `restart`, and similar | Per-command elevation for changes      |

## macOS

The installer asks for an administrator password once, the standard macOS installer flow. There is no kernel extension and no patching of system frameworks.

<AccordionGroup>
  <Accordion title="Background items and notifications">
    Velatir runs as a background service, so macOS 13 and later tells the user it "added items that can run in the background" and offers to switch them off. Separately, macOS holds notifications from a newly installed app back until the user opts in. On managed Macs, two quiet-install profiles settle both before the user sees either. Download them from the builder on [Enterprise deployment](/desktop-app/enterprise-deployment).
  </Accordion>
</AccordionGroup>

| Prompt                              | When                                                  | What it grants                                                                   |
| ----------------------------------- | ----------------------------------------------------- | -------------------------------------------------------------------------------- |
| Administrator password              | At install                                            | Permission to run the installer                                                  |
| Background items added              | First run                                             | Notice only. The user can switch Velatir's background items off from Login Items |
| Notification permission             | First alert                                           | Permission for Velatir to show alerts                                            |
| Authorisation for some CLI commands | Running `velatir set-api-key`, `restart`, and similar | Per-command elevation for changes                                                |

## Next steps

<CardGroup cols={2}>
  <Card title="How it works" icon="layers" href="/desktop-app/how-it-works">
    What the desktop client does on each device.
  </Card>

  <Card title="Enterprise deployment" icon="building" href="/desktop-app/enterprise-deployment">
    Silent install and MDM rollouts.
  </Card>

  <Card title="Data privacy" icon="lock" href="/security/data-privacy">
    What Velatir stores and how it scrubs sensitive content.
  </Card>

  <Card title="Troubleshooting" icon="life-buoy" href="/desktop-app/troubleshooting">
    Diagnose approval and first-run issues.
  </Card>
</CardGroup>