Windows permissions

The installer is per-user and the app runs unelevated. Enumerating sockets and reading a process's working directory are both possible with unprivileged Windows APIs, so there is no reason to ask for more.

If something prompts you for administrator rights during a Pip install, it did not come from us. Stop, and check what you downloaded.

One thing: processes started from an elevated terminal cannot be killed by an unelevated app. Pip still detects and lists them, marks them as elevated, and says so — the trade is a visible limit instead of a permission prompt you would have to trust.

Pip does not listen on any port, so Windows Firewall has nothing to prompt you about and no rule to add. The only traffic is the outbound activation call.

SmartScreen is a different matter — it warns about installers it has not seen signed by a known publisher. What to do when Windows warns you.