Devices
A device is a computer you have paired with a Workspace by installing the Agent Orchestrator desktop client on it.
A device is a computer you have paired with a Workspace by installing the Agent Orchestrator desktop client on it. Paired devices let agents ask for help that only your own machine can give — reading or writing a file, the clipboard, a screenshot, the keyboard and mouse, a browser tab, or listening and speaking. What an agent may ask is decided by a policy, and the client applies its own checks on the device as well.
With the browser extension installed on that device, an agent can list your open tabs, open a new tab, change a tab it names, read a page or screenshot one. Opening a tab is the safe way to be shown something: an agent can never change the tab you are looking at without naming it first, and every one of those calls shows you the real page title and URL before it runs.
Status of the desktop client: it is tested on Linux. The Windows installer and the macOS app are built but have not yet been run on those systems, and they are unsigned, so your system may warn you when you install them.
The Devices Page
Sidebar → Devices. (A System Administrator can hide the Devices page for everyone in Global Settings → Feature Flags; if you do not see it, that is why.) The page has three parts: Get the client, Paired devices and Capability policy. Use Reload to refresh it.
Get the Client
The Get the client table lists the builds your administrator has made available (Platform, Build, Size, Download). If it is empty, no installers have been provided for this instance yet. Install the build for your platform, then run ao-client pair on that computer.
Pairing a Device
- Press Pair a device. A pairing code appears. It works once, is shown once and expires after about 10 minutes.
- On the computer with the client installed, click Open in desktop client — or enter the code in the client (
ao-client pair). - The device appears under Paired devices.
Viewer members cannot pair devices.
Paired Devices
The table shows Device, Owner, State, Last seen and Capabilities. Select a device to see:
- Declared capabilities — What the client says it can do
- Effective decision — What the policy means for each capability on this device
- Recent calls — Each call with its Status and When
File contents, clipboard text, screenshots and speech are not kept in the call record.
- Revoke — Disconnects the device and invalidates its credentials at once. The owner or an Administrator can revoke. A revoked device must be paired again.
- Delete — Removes a revoked device from the list. Administrators only.
Capability Policy
The Capability policy table has one row per capability: Capability, Risk, Decision and Source (where the decision comes from — the built-in default, the Workspace or a specific agent).
| Decision | Meaning |
|---|---|
| Deny | Agents cannot use it; it is not even offered to them |
| Allow | Runs without asking |
| Ask once | You are asked the first time; if you choose always, that applies for the rest of that Run |
| Ask every time | Every call needs your approval |
Everything is denied unless a default or a setting allows it, and high-risk capabilities start at Ask every time. Rows left at their built-in default are not stored, so a later change to a default still reaches you. Only a Workspace Administrator can change the policy (Save policy / Discard); everyone else sees it read-only.
Approving a Request
When the decision is Ask once or Ask every time, the request appears in the Task chat as an approval card, like an agent’s question or permission request. Allow it (once or always) or deny it there. With Ask once, always applies for the rest of that Run; with Ask every time you are asked again for each call. A request nobody answers within 10 minutes times out and is not run.
On the Device
The client checks every request again on your computer and can ask you for consent there, independently of the server. Pause agent access in the client blocks everything until you resume it.