What the click buys
A UAC consent grants the child process a full-integrity token: write HKLM, services, drivers, other users' profiles. The check-box remembering is absent for a reason — per-invocation scrutiny is the boundary.
The frequency tell
0 prompts ever
per-user tool — its whole feature set fits your account
1 at install
per-machine install; runtime may still be politely constrained (look for it)
1 per feature
the architecture is machine scope pretending not to be — walk away for tuning workloads
Reading the prompt itself
- Publisher name & signature state are the first evidence literals — unsigned + generic name is a hard no for evaluation machines.
- “Show more details” exposes the call-line: read it once against what you clicked. Circling-back mismatch = uninstall, always.
- Task Manager's Elevated column (Details tab) later shows which of your running tools currently hold that scope token; on a tuning box the honest count is zero outside installs.
Per-account products end this conversation structurally; see why the flash ask never stops for the contract angle.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.