Some apps on your Mac stay limited in computer use, even if you allowed them.
- Never used: Keychain Access, Passwords, System Settings, Script Editor, Automator, password managers such as 1Password, Bitwarden, LastPass, Dashlane, KeePassXC, Proton Pass and Enpass, and the macOS prompts that approve permissions or authenticate as an administrator. Do these parts yourself.
- See, click and scroll, never type: terminals and code editors, such as Terminal, iTerm, Warp, Ghostty, VS Code, Cursor, Windsurf, Zed, Xcode and JetBrains apps. The agent runs commands in its own shell instead.
- Every other app: the agent can see, click, type and scroll once you allow it.
Web browsers count as every other app, so they can be used fully, with your own sign-ins. The question that asks you to allow a browser says so, and warns that pages can contain misleading instructions.
When an agent asks to use an app, the question says what it can do there. A request that goes past an app's limit is refused.
Where: Mac app, during computer use.
Good to know: to lend one Chrome tab instead of the whole browser, see Let an agent act in your own Chrome tab. Related: Allow an agent to control a specific app, What is computer use?.