To limit what files an AI agent can read, change, or delete on Windows, give the agent its own Windows account, put its work in a dedicated folder, and grant that account only the NTFS permissions the task needs. Windows does not give an agent a permission boundary just because it is an AI agent. The agent can touch whatever the account running it can touch, so the account and the folder’s security settings are the controls that matter.
Why the agent’s account decides what it can reach
When a program opens a file, Windows compares the access it requests with the security token of the process and the file’s security descriptor. The security descriptor holds the discretionary access control list (DACL), which lists users and groups and the rights each one has. If the agent runs as your signed-in user, it inherits everything that user can do, including reading your documents and deleting files in your profile. Changing the agent’s tool settings or prompts does nothing to these checks.
As an Amazon Associate I earn from qualifying purchases.
That is why the first decision is identity, not the agent’s configuration. Identify the exact Windows account that launches the agent. It might be your own user, a service identity, or a separate local account created for the job. Your agent product’s documentation should say which one applies. If it does not, check the account yourself by running a command such as whoami from the same launch context the agent uses.
Set up a dedicated working folder and account
Use a layout in which the agent has one place to work and no other reason to be in your files:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Working folder: for example
C:AgentWork. Store the task inputs and outputs here only. - Private material: keep personal documents, credentials, and unrelated projects outside that folder’s tree and out of any location the agent’s account already has rights to.
- Agent account: a standard, non-administrator account used only for the agent. Creating a separate local user is the cleanest option, because you can grant it rights without touching your own profile.
Keep the account out of the Administrators group. Avoid granting it ownership of files, the Backup Operators or Restore privileges, or membership in groups that already have broad access to your drives.
Grant permissions with the Security tab
Use File Explorer to set the folder’s rights. The steps below apply to the working folder, not to your user profile or the whole drive.
- Right-click
C:AgentWorkand choose Properties. - Open the Security tab and review the listed users and groups.
- Select Edit…, then Add…. Type the agent account’s name, select Check Names, and choose OK.
- Select the new entry and tick only what the task needs. For inspection or summarising tasks, tick Read & execute, List folder contents, and Read. Tick Modify only when the agent must create, edit, or delete files inside the folder.
- Select OK to close the dialogs and apply the change.
The same rights can be set from an elevated Command Prompt with icacls. Read-only access for a hypothetical account named AgentSvc looks like this:
Recommended Free Tools
icacls "C:AgentWork" /grant "AgentSvc:(OI)(CI)R"The (OI)(CI) flags make the entry apply to files and subfolders inside the folder. Use (M) instead of (R) for modify access. Run icacls "C:AgentWork" with no other arguments to list the entries that now exist.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check inherited permissions before you trust the folder
A folder’s explicit entries are not the whole picture. Files and folders can inherit ACL entries from their parents, and an inherited grant can give the agent more access than the entry you just added suggests. Inheritance flags determine whether an entry applies to the folder itself, flows down to children, or applies only to children.
To inspect this in the GUI, return to the folder’s Security tab, select Advanced, and read the list of permission entries. Entries marked as inherited come from a parent. If a broad group such as Users or Authenticated Users appears with rights over a location that holds private files, the agent’s account may reach those files through that group even when your own entry is narrow.
Removing inheritance is possible from the Advanced dialog, but it can lock out accounts that need access. Copy the existing entries before you change inheritance, and only remove inherited rights after you confirm the agent still has what it needs.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUnderstand the rules behind the checks
Microsoft documents two behaviours that affect how you read an ACL. An object with no DACL grants full access to everyone. A DACL with no entries denies access to everyone. An empty-looking permission list is therefore not automatically safe, and you should confirm the result with a test rather than assume it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Ownership is a separate lever. Microsoft states that an object’s owner can change its permissions even when the owner is denied access. If the agent’s account owns a file, it can rewrite that file’s permissions. For the same reason, do not give the agent ownership as a workaround for an access-denied error. Find out which entry is blocking the access and grant the narrowest right that fixes it.
Some file-system privileges, such as backup and restore privileges, can override normal access checks in defined circumstances. An agent account holding those privileges is effectively exempt from the ACL rules you set, so keep them out of the agent’s account.
Test the boundary with the agent’s identity
Do not treat the setup as finished until you have tested it as the account that will run the agent. Create two harmless files, one inside the working folder and one outside it, such as C:Privatetest.txt. Then sign in as the agent account, or start a session under it with runas /user:.AgentSvc cmd, and try these checks:
- Reading the file in the working folder should succeed.
- Reading
C:Privatetest.txtshould fail with “Access is denied”. - Writing a new file to the working folder should succeed only if you granted Modify. Otherwise it should fail.
If an out-of-scope read succeeds, check the inherited entries described above before you rely on the setup. Run the same tests again after any change.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Choose between folder permissions and Windows Sandbox
Folder permissions and Windows Sandbox solve different problems. The table compares them on what they limit.
| Approach | What it limits | Where it fits | Main caveat |
|---|---|---|---|
| NTFS folder permissions for a dedicated account | Which host files the agent’s account can read, write, or delete | An agent that runs as a normal Windows process and needs a bounded set of host files | Only file and folder access is controlled; the account’s other rights still apply |
| Windows Sandbox | Isolates an untrusted Win32 application in a separate environment | Untrusted Win32 apps where an isolated environment is acceptable | Not established by the sources that every agent framework runs correctly inside it; agents that must reach host files need a different arrangement |
Microsoft’s Windows 11 Security Book, in its Application Isolation section, states: “Any untrusted Win32 app you install in Windows Sandbox stays only in the sandbox and can’t affect the host.” That is a statement about isolation for the apps it covers. Before you rely on it for an agent, confirm that the agent runs inside the sandbox and that the files it needs are either copied in or intentionally shared.
Microsoft’s AI defense guidance gives the principle behind both options: “Bind permissions to the initiating principal and task, limit them to the minimum required scope, and issue them for the shortest practical duration.” In practice, that means a dedicated account for each agent or task, the narrowest folder scope, and rights you remove when the job ends.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What folder permissions do not cover
NTFS permissions govern file and folder access only. They do not decide which websites, network services, registry keys, or APIs the agent can reach, and they do not stop an agent from sending a file’s contents somewhere else if the agent is allowed to read it. If the agent has network access, treat any file it can read as something that may leave the machine. Limit both file rights and network access, and review the agent product’s own tool and permission settings, which are the only place to control agent-specific capabilities.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Also note that this guide describes the general Windows model. Agent products differ in how they launch processes, which account they use, and whether they run tools in child processes that might have different identities. Verify the identity and run the tests above with the same launch method you use in production.
Recovery when access breaks
- Agent suddenly cannot read its own folder: confirm the account name is still correct in the Security tab, then check whether a deny entry or a removed inherited grant changed the result.
- Accidental access to a private folder: remove the agent account’s entry from that folder’s Advanced permissions, rerun the outside-scope test, and review the agent’s logs for files it opened.
- Permissions were changed through ownership: restore the folder’s original entries from your saved list, and remove the agent account as owner if it was granted ownership.
Bottom line
Windows will enforce whatever ACLs you set, but it enforces them against the account that runs the agent. Create a dedicated, non-administrator account, give it a single working folder with read or modify rights only as needed, check inherited entries, and test the boundary with the same identity the agent uses. Use Windows Sandbox only as a separate isolation option for untrusted Win32 applications, and confirm it works with your agent before relying on it.
For agent-specific details such as which account the agent launches under, consult the agent product’s own documentation.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
