A micro app may need file, clipboard, network, or device capabilities to complete a task. Permission prompts let you make an informed decision before access occurs; they are not a request to approve everything by default.
Ask three questions before allowing access
- Why is it needed? Is the request directly related to the main purpose described on the detail page?
- What can it reach? Could it expose private files, screen content, account information, or communications?
- Can the scope be smaller? Can you choose one file, one action, or a shorter period?
If any answer is unclear, deny the request and stop the app.
Common permission types
Desktop characters and permissions
A desktop pet, companion, or other persistent character does not automatically gain access to files, the screen, or system information merely because it appears on the desktop. A companion that only moves, responds to clicks, and can be dragged normally does not need those permissions.
When a character gains a specific feature, Aelrox prompts for that feature separately. Showing computer resources needs system information; observing application usage needs application and process performance; reacting to screen content needs screen access; and organizing dropped files needs the matching file-action permission. Judge each request by what you asked the character to do. Being a desktop character is not, by itself, a reason to allow access.
If you deny one permission, the character should retain its basic appearance, dragging, and local interactions. System monitoring, file actions, and screen reactions should fail or become unavailable independently. They must not pretend to succeed or repeatedly pressure you to allow access.
A desktop character can keep local keyboard controls without taking focus from other apps all the time. It should enter keyboard mode only after you explicitly click an actionable area and should show a clear visual cue. Escape, focusing another window, starting a drag, hiding the character, or closing it should exit that mode immediately. Enter, Space, or text input then goes only to the focused character control; this is not background global-key monitoring and does not require the Global Keyboard permission.
Aelrox checks before generation is saved or published that a character actually contains the features it claims to support. A character that only names a feature without implementing the corresponding behavior is blocked. If an installed character still behaves differently from its description, stop it and report it.
A desktop companion is an ordinary JavaScript or Python micro app. It uses the same single runtime, package assets, lifecycle, signing, permission checks, and validation rules as every other micro app. Aelrox does not infer a special runtime from transparency, file names, animation assets, or the word “pet.”
The creator may configure a transparent, chrome-free ambient window and may use ordinary packaged images or an optional animation dependency. There is no built-in character renderer, Renderer Pack, fixed state vocabulary, or mandatory Sprite Player. Dependencies and assets do not grant permissions; sensitive work still goes through the same Native SDK capability gates.
Movement is also an ordinary window capability. A companion stays stationary unless its product behavior explicitly uses the window-motion APIs. Direct dragging, click-through input regions, and autonomous movement are independent choices and should match the public description.
Click-through input regions define where a transparent companion responds to the pointer; they do not crop or hide visible content. On Windows, visual surface clipping is a separate creator choice and should be used only when the public design intentionally limits the visible surface.
When you drop files onto a companion, only that current drop inside its interactive area is passed to the micro app. Inspecting, organizing, or moving items to Trash still requires the matching permission and visible per-operation results. If you deny the permission, unrelated appearance and local interaction should continue to work.
Timers, system status, settings, history, and other features run in the same declared micro-app runtime and may use ordinary views where appropriate. Callbacks may pause while the device is locked, asleep, or suspended; after resume, countdowns should recalculate from the real deadline instead of replaying missed updates. Permissions remain feature-specific.
Recording desktop characters
When Aelrox Recorder captures a display or desktop region, any visible desktop character in that area appears in the video. You can still click the character, enter its local keyboard mode, or drag it after recording starts, and those actions and animations are captured. The recording frame lets pointer input pass through instead of placing an interactive shield over the selected area.
Hide or close a character before recording if you do not want it in the video. A character does not need Screen Recording permission merely to appear in the captured desktop; only the micro app that starts recording requests that permission. Windows or macOS may still show its own screen-recording authorization and status indicators.
Files and folders
The app may read or save selected content. Choose only the files required for the task, not an entire personal directory. Before uploading or transforming a file, remove passwords, keys, and unrelated private information.
Dropped-file actions
Some desktop micro apps can act on files, folders, shortcuts, or applications that you drop directly onto them. Examples include open, reveal, copy, move, rename, duplicate, archive, extract, and move to the system Trash. Aelrox limits the action to items in that drop. The micro app does not receive their full paths and cannot use this feature to scan your Desktop or other folders. Permissions are separated into viewing dropped items, organizing files, and moving items to Trash; allow only the action families that match the app's stated purpose.
These actions never silently overwrite an item with the same name. Copy, move, archive, and extract ask you to choose a destination, then either keep both items or skip a conflict. Moving to Trash is not permanent deletion: successful items can usually be restored from Windows Recycle Bin or macOS Trash, but Aelrox does not promise one-click undo. Back up important files and review per-item results when an animation or message says an operation was only partly completed. A shortcut or symbolic link is handled as the dropped item itself; its target is not followed.
Micro app entries in search
Micro apps with persistent search entries, such as Quick Shelf, can keep registered items searchable after their window closes. Search looks up entries saved and supplied by the micro app; it does not grant new file, network, or other permissions. Opening a website, file, or folder still requires you to select a result and remains subject to the existing permission checks.
Unregistering or deleting an entry in the micro app should remove it from search. Searches beginning with / include system content only, excluding micro app entries. If a registered item cannot be found, record the micro app name, version, and search term and report the issue through Feedback.
Clipboard
Your clipboard may contain a recent verification code, address, or private message. Allow access only for a clear copy or paste action, not for a feature unrelated to the clipboard.
Network access
Network access may send input to an external service. The detail page should explain whether connectivity is required and why. For private data, confirm the recipient and necessity before continuing.
Audio playback
The Audio Playback permission lets a micro app or desktop character play its declared sounds. It does not include microphone recording and does not grant file, screen, or network access. A character with a voice reaction may play a short packaged clip from an isolated background component after you explicitly click or double-click it; its animation still cannot read other data.
If you deny Audio Playback, the character should remain visible and complete its click, drag, mouth, or other visual action without sound. Playback should match the public description and your current action. Stop and report a character that plays repeatedly without interaction, loops unexpectedly, cannot be stopped, or uses sound for an undisclosed purpose.
Screen, camera, and microphone
These permissions may capture your surroundings or content in other applications. Close unrelated windows before starting, watch system indicators, and stop capture when the task is complete.
System resources and hardware information
The “system resources and hardware information” permission can read whole-system CPU, memory, and load together with requested device states such as battery, temperature, disk, storage, and network counters. It does not grant access to another application's window contents, files, or activity history. Reading running application names and per-application usage requires the separate “application and process performance” permission.
To reduce power use and fan activity, Aelrox lets multiple micro apps reuse the same system samples and limits how often slower information such as battery, temperature, and storage is collected. A live view should stop refreshing when hidden or suspended; after resume, it may briefly show the last result while a fresh sample completes. Cached or temporarily partial data does not mean usage is zero.
Allow this permission only for a system dashboard, resource indicator, or hardware overview you requested. Stop and report an app if it keeps refreshing while hidden, uses high-frequency changes to manufacture urgency, or describes a single temperature or load reading as proof of hardware failure.
Application and process performance
The “application and process performance” permission can read the names of running applications together with privacy-filtered CPU, process-resident memory, process count, thread, uptime, and optional low-frequency disk/network activity observations. It does not expose executable paths, commands, launch arguments, user names, or process identifiers to a micro app.
The memory value is the resident memory of an application's member processes (also called the working set on Windows), not the operating system's overall used memory. Processes can share memory pages, so per-application and all-application totals may count shared memory more than once. Apps should use these observations to explain performance symptoms, not to claim that hardware is failing or present a definitive system diagnosis.
Allow this permission only when you intentionally analyze slowdowns, fan noise, or application resource use. Live observation should stop when the view closes. Stop and report an app if it samples continuously, uses the permission for an undisclosed purpose, or presents alarming conclusions without sufficient evidence.
Activity summary and selected windows
“Activity summary” provides only coarse states such as active, quiet, or idle and whether the pointer is near the micro app. It does not provide precise pointer coordinates, keystrokes, activity in other apps, or screen images. If you deny it, the app should keep a basic experience that does not depend on those states.
“Selected window observation” starts only after you choose a window and provides its name, position, size, visibility, and unavailable state. It does not provide window pixels or document content. If the target closes, permission is denied, or the platform cannot observe it, the app should stop following and fall back safely instead of selecting another window automatically.
Input, windows, and device capabilities
Simulated input, window control, or hardware access can affect other applications. Allow it only for a clear purpose, a trusted source, and the current task, and observe the app while it runs.
Warning signs
Stop immediately if a micro app:
- asks for a password, verification code, recovery token, or payment details;
- requests access unrelated to its public purpose;
- tells you to disable system security or bypass a warning;
- requires a transfer, an unknown download, or continuation in an external chat;
- behaves materially differently from its detail-page description;
- pressures you after denial, repeats prompts, or prevents you from leaving.
Safer habits
- Prefer apps with a clear source, complete description, and recent version.
- Test with non-sensitive sample data first.
- Back up important files before changing them.
- Close apps you no longer need.
- Review account sessions and system permissions periodically.
- Do not treat “reviewed” as a permanent guarantee of safety.
Creator responsibility
If you publish through AI Builder, accurately describe the purpose, network behavior, and expected permissions. Request only the minimum access needed for the core task and update the public description whenever behavior changes.
Report a problem
Stop the micro app and avoid entering more data. Record its name, version, time, steps, and permission prompt, then report it through Feedback.
Screenshots and logs may contain private information. Remove passwords, verification codes, tokens, and private file paths or content before submitting. If an account or payment method may be affected, also change credentials and contact the relevant provider.