Different from sharing your current screen
Delegated server access lets a prepared, enrolled agent open authorized terminal sessions to a selected destination. The agent holds an encrypted copy of the target credential and uses it for permitted access. This is a different trust arrangement from forwarding an encrypted view of your current live terminal.
The agent machine, its operator and its unlocked credential environment are trusted participants. Do not delegate a credential to an agent you do not control or trust.
Use a saved SSH connection with a verified host key and an exportable password or SSH private key. Hardware-backed keys cannot be copied into the agent's credential storage. Account-based access invitations are unavailable for self-hosted relay connections.
Grant access deliberately
- Have the administrator install the correct agent release, complete its supported enrollment and unlock its credential storage. During delegated setup, run the native enrollment command supplied for the intended server and independently verify and pin the connector's public key.
- Open Share for that saved server, choose Server Access, then Configure Server Access where offered. Sign in and unlock secure storage when prompted.
- Verify the agent identity, destination, permissions and expiry, then create and privately send the invitation to the intended recipient.
- After the recipient opens it with a signed-in account and unlocked secure storage, choose Review and approve the intended authenticated recipient. Complete the credential and authorization prompts for the target. This is different from room-wide approval of a relay Live Share invitation.
- Wait for the agent to confirm installation of the grant; creating an invitation alone is not proof that access is ready.
- Test the recipient's actual permitted workflow before relying on unattended access.
Browser and native invitation workflows both use the enrolled agent. Viewing an agent-owned terminal and controlling it are separate permissions. To invite an observer, select an existing active agent terminal; start a delegated control session first if none is listed. Observation ends when that terminal or its access expires. Only a control session can send terminal input or resize that terminal.
Keep the agent available
The agent must remain running, authorized and appropriately unlocked. After a reboot or agent restart, an operator must unlock credential storage locally again. Do not assume installing a background service gives it unattended access to locked credentials.
Loss of connectivity must not be treated as an extension of permission. Check both access status and agent readiness when a recipient cannot connect.
Remove access and confirm the outcome
Revoke the intended grant and check the reported result. When cutoff cannot be confirmed, investigate rather than treating a button press as proof of success. Stopping access does not erase material a recipient already copied or undo previously executed work.
Use Live Share for collaboration on your existing terminal. Read privacy and trust before choosing the delegated model for a sensitive server.