---
title: "Installs and local privileges · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges
parts: 5
tokens_total: 5241
updated: 2026-10-27
build: a2a6bdfed830
tokens: 850
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Installs and local privileges

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Desktop apps and extensions](https://agentwranglers.se/playbook/desktop-apps.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Load libraries from safe folders, guard privileged helpers, ask for system permissions when a feature needs them, and start at login only on request.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges">Agent Wranglers desktop apps and extensions playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- DSK-27 [Load libraries only from folders attackers cannot write](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/safe-library-loading.md) · 1,036 tokens · updated 2026-10-22
  At start-up on Windows, limit the library search to the app's own folder and System32 with `SetDefaultDllDirectories`. Load every other library by its full path. Install machine-wide apps under Program Files, where only administrators can write.
- DSK-28 [Check who is calling before a privileged helper acts](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/privileged-helper-callers.md) · 1,190 tokens · updated 2026-10-27
  A helper or service that runs as root or SYSTEM accepts connections only from your own signed app, or from the signed-in users on Windows. It performs only actions from a fixed list, with checked arguments.

## Recommended

- DSK-29 [Start at login only after the user turns it on](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/login-item-consent.md) · 888 tokens · updated 2026-10-22
  Add the app to the login items or startup list only when the user turns on a switch in its settings. The switch starts off. Stop every background process when the user quits, unless they chose to keep one running.
- DSK-39 [Ask for system permissions only when a feature needs them](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/privacy-prompts.md) · 1,043 tokens · updated 2026-10-27
  Request each system permission, such as camera, microphone, screen recording, location or contacts, at the moment the user starts the feature that needs it. Give each one a purpose string that names the feature, and keep the app working when the user says no.
- DSK-40 [Ask the Linux sandbox for the fewest permissions](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/linux-sandbox-permissions.md) · 1,084 tokens · updated 2026-10-27
  Ship Flatpak and Snap packages with sandbox permissions limited to what the app uses. Use portals or interfaces for files and devices, and never grant the whole home folder, the whole file system or full session bus access.

- Previous: [Browser extensions](https://agentwranglers.se/playbook/desktop-apps/browser-extensions.md)
- Next: [Crashes, telemetry and accessibility](https://agentwranglers.se/playbook/desktop-apps/crashes-telemetry-and-accessibility.md)
- [All chapters](https://agentwranglers.se/playbook/desktop-apps.md)