Limited Availability: Horizon Delegate Security and Data Protection

Horizon Delegate includes controls that keep its actions within the user's entitlements and limit the data that leaves the remote desktop.

Identity

Horizon Delegate runs in the remote desktop session as the logged-in user, with that user's entitlements. It does not escalate privileges. MCP tools also run as the logged-in user.

Horizon Delegate cannot bypass multi-factor authentication or conditional access prompts while it runs a task.

Data loss prevention

When the prompt data loss prevention setting is enabled, which is the default, Horizon Delegate scans each user prompt before the prompt is sent to the AI provider. The built-in rules detect data such as credentials, API keys, AWS keys, GitHub tokens, private keys, email addresses, and US Social Security numbers. Each rule determines how Horizon Delegate handles a match.

Important: Data loss prevention scans user prompts only. Horizon Delegate does not scan tool calls or responses from the AI provider.

Conversation history

Conversation history is stored on the remote desktop, where Horizon Agent and Horizon Delegate run.

Session lock

The session lock setting controls whether users can use Horizon Delegate while the Windows session in the remote desktop is locked. The setting is enabled by default. See Horizon Delegate Group Policy Settings.

When the setting is enabled and the Windows session is locked:

• The Horizon Delegate panel is hidden in every layout, and the user sees the Windows lock screen.
• Horizon Delegate does not accept requests, approval responses, history requests, or settings changes, and it sends no updates to the client.
• A request that is already running continues and is not canceled.

When the user unlocks the session, the Horizon Delegate panel appears again with the previous layout, and the conversation reloads. The lock state applies to the whole Windows session.

When the setting is disabled, Horizon Delegate remains usable while the Windows session is locked.