> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xpander.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Your settings and your organization's policy

> Your organization's Desktop policy sets the most agents may do on a computer. Your own switches in Settings can turn any of it off for your computer, and decide whether agents work on your computer or in the cloud first.

Two sets of switches decide what agents may do on your computer:

* **Your organization's [Desktop policy](https://docs.xpander.ai/desktop/admin.md#desktop-policy)** sets the most that is allowed. An admin sets it for the whole organization and per group.
* **Your own switches**, in [Settings](https://docs.xpander.ai/desktop/settings.md) > **Shell & files** and **Computer control**, can turn any of that off for this computer. They never allow more than the policy.

What agents can do is what both allow. On top of that, the first use of the shell, file writes, the browser or computer control in a conversation still asks you (see [the shell](https://docs.xpander.ai/desktop/shell.md#allow-commands-and-file-changes-for-a-chat), [browser control](https://docs.xpander.ai/desktop/browser.md#allow-it-for-a-chat) and [computer control](https://docs.xpander.ai/desktop/computer-control.md#allow-it-for-a-chat)).

## Your switches

Everything starts on. Settings > **Shell & files** has:

| Switch | What turning it off does |
| - | - |
| **Files** | **Read and write**, **Read only** or **Off** for every trusted folder on this computer. Only the levels your organization allows are offered. Off also turns the shell off. |
| **Shell commands** | Agents cannot run commands on this computer. |
| **Shell network** | Commands still run, but cannot download packages or call web services. Shown while files and the shell are on. |
| **App automation** | Commands cannot drive other apps with AppleScript. |
| **Browser control** | Agents cannot use the [Omni browser](https://docs.xpander.ai/desktop/browser.md) on this computer. |
| **Move work to the cloud** | You cannot [move a conversation](https://docs.xpander.ai/desktop/move-to-cloud.md) to the cloud from this computer. |
| **Bring work back to this Mac** | You cannot bring cloud files back to this computer. |

**Folders that may be trusted** shows your organization's folder rules: **Any folder**, the folders it allows, or **None**. You cannot change it.

Settings > **Computer control** has the **Computer control** switch and the macOS permissions it needs. See [Computer control](https://docs.xpander.ai/desktop/computer-control.md).

![Shell and files settings: Files set to Read and write, switches for Shell commands, Shell network, App automation, Move work to the cloud, Bring work back to this Mac and the two Prefer this Mac switches, Folders that may be trusted reading Any folder, and Browser control reading Not allowed](https://mintcdn.com/xpanderai-099931d1/5kO48nCPjVxjKi_K/images/desktop/settings-shell-and-files.png?fit=max\&auto=format\&n=5kO48nCPjVxjKi_K\&q=85\&s=506da136029db24524e61d7163fb2d23)

Settings > Shell & files, with browser control turned off by the organization. Shown with sample data.

## When your organization does not allow something

A switch your organization's policy turns off is replaced by **Not allowed**, with **Your organization does not allow this.** You cannot turn it on from the app; ask an admin.

When your organization turns Omni Desktop off for you, the menu bar icon reads **Turned off by your organization** and the sidebar shows **Mac turned off**. Agents cannot reach this computer until an admin turns it back on.

Policy changes reach your computer while the app runs. Nothing needs a restart.

## Prefer this computer or the cloud

Agents also have a workspace and a browser in the cloud. Two switches in **Shell & files** decide where they work first, in conversations you start from the app:

| Switch | On (the default) | Off |
| - | - | - |
| **Prefer this Mac's files and apps** | Agents work on this computer first: your trusted folders, the shell and your apps. | Agents work in the cloud, and use this computer when you ask them to. |
| **Prefer this Mac's browser** | Agents browse in the Omni browser on this computer first. | Agents use the cloud browser, and browse on this computer when you ask them to. |

Turn one off when you want agents to keep working after you close the lid, or to keep work off your computer unless you ask for it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.