Cua explained: computers, drivers and benchmarks for agents
Cua security: policy ceilings, host permissions and screenshots
Apply runtime controls before giving an agent desktop or shell access.
What you will learn
- Place policy at the action boundary
- Limit the target machine
- Exercise a denial
Before you start
- A disposable target and permitted task
- Basic understanding of host versus guest state
Capture observation, action, policy and final state for one bounded desktop task.
Key takeaways
- Policy evaluation precedes native dispatch.
- Host and guest targets have different exposure.
- Observations and trajectories need retention rules.
Place policy at the action boundary
The Driver policy documentation says public SDK, MCP and daemon paths ask a shared coordinator before dispatch. An explicit policy is deny-by-default for unmentioned tools; invalid configured policy files fail runtime construction.
A managed policy is an administrator ceiling. User policy and permission mode cannot widen it. Confirm the active policy snapshot and restart the runtime after changing policy, because the documented version does not hot-reload it.
Limit the target machine
A Driver targeting your host can see or change host state. A sandbox contains work in a guest, but shared files and exposed services connect it to the outside. Use synthetic accounts and an allowlist matched to the task.
Screenshots, accessibility trees and trajectories may carry private information. Define retention and access controls for those artifacts before collecting them for debugging or evaluation.
Exercise a denial
Write a harmless forbidden action, send it through the same public path the agent uses and confirm it is denied before implementation. Also test that the permitted task still works.
This is a proposed verification, not a penetration test run for the article. Inspect all installed adapters and model artifacts under their own licenses and policies.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Review managed and user policy before launch.
- 2
Use a disposable target and synthetic accounts.
- 3
Test both one permitted and one denied action.
Copy-ready example
policy_trial:
target: disposable-guest
managed_ceiling: reviewed
allow: calculator-action
deny: unrelated-file-action
restart_after_policy_change: yesFrequently asked questions
Does standard mode bypass a managed policy?
The docs say no mode widens managed or user policy ceilings.
Can I edit a policy file while Driver runs?
The documented snapshot is loaded at startup; restart the runtime for changes to take effect.
Sources
- Cua / docs/content/docs/concepts/how-permission-policies-work.mdxSource checked 2026-09-29
- Cua / docs/content/docs/concepts/how-sandboxes-work.mdxSource checked 2026-09-29
- Cua / README.mdSource checked 2026-09-29