Why does a Mac app ask for access to my files and camera?
When a Mac app wants your camera, your microphone, your contacts or a protected folder, macOS shows a prompt with a sentence in it. That sentence is written by the developer and shipped inside the app, which means it can be read out of the bundle before you ever run the app.
What a declared permission is
It is a usage description: a key naming the resource and a sentence explaining why the app wants it. macOS refuses to show a prompt without one, so an app that intends to ask for your camera must ship the declaration. That makes the set of declarations a reasonable preview of what an app will ask for.
The listing also shows entitlements, which are capabilities granted by the code signature rather than by you — loading outside plug-ins, JIT compilation, sending Apple Events to other apps. You are never prompted for these, which is exactly why they are worth showing.
How we read it
The declarations come out of the bundle's Info.plist and the entitlements out of its code signature. Both are read from the shipped app, and each listing links to the artifact that was opened.
Identifiers are shown alongside plain English rather than instead of it, and an identifier we do not have a translation for is still shown, unchanged. Hiding a permission because we do not recognise it would be the one failure mode that matters here.
What it does not mean
A declaration is not a grant. It says the app is able to ask; it does not mean macOS has given it anything, and you can see and revoke what you have actually granted in System Settings under Privacy and Security.
A long list is not a red flag by itself. A screenshot tool legitimately needs screen recording, and a video app needs the camera. The useful question is whether each one matches what the app is for.
Most importantly, the two permissions people worry about most are not in a bundle at all. Accessibility and Full Disk Access are requested while an app is running, not declared in advance, so an app that shows no declarations can still ask for both. An empty list means the bundle declared nothing, not that the app will never ask for anything.
Every permission and entitlement, in plain words
These are the identifiers that appear on a listing and what each one lets an app ask for. An identifier we have no translation for is still shown on the listing, unchanged.
Sandbox
- App Sandbox
- Runs inside the macOS sandbox: it can reach only the files, devices and services the rest of its entitlements name.
app-sandbox - Inherits sandbox
- A helper process that takes its parent's sandbox rather than declaring its own.
inherit
Files
- Desktop folder
- Can ask to read and change files in your Desktop folder.
DesktopFolder - Documents folder
- Can ask to read and change files in your Documents folder.
DocumentsFolder - Downloads folder
- Can ask to read and change files in your Downloads folder.
DownloadsFolder - File provider
- Can appear as a location in Finder, the way a cloud-storage client does.
FileProviderDomain - Other file providers
- Can ask to see which cloud-storage providers are set up on your Mac.
FileProviderPresence - Network drives
- Can ask to read files on network shares.
NetworkVolumes - External drives
- Can ask to read files on USB sticks and other removable drives.
RemovableVolumes - All files
- May read and write anywhere your account can. A sandboxed app with this entitlement has given up most of what the sandbox restricts.
files.all - Remembers files
- May keep access to a file you once chose, so it can reopen it next launch without asking again.
files.bookmarks.app-scope - Remembers related files
- May keep access to files referenced by a document you opened.
files.bookmarks.document-scope - Downloads folder (read-only)
- May read your Downloads folder without asking each time.
files.downloads.read-only - Downloads folder
- May read and write in your Downloads folder without asking each time.
files.downloads.read-write - Movies folder (read-only)
- May read your Movies folder.
files.movies.read-only - Movies folder
- May read and write in your Movies folder.
files.movies.read-write - Music folder (read-only)
- May read your Music folder.
files.music.read-only - Music folder
- May read and write in your Music folder.
files.music.read-write - Pictures folder (read-only)
- May read your Pictures folder.
files.pictures.read-only - Pictures folder
- May read and write in your Pictures folder.
files.pictures.read-write - Programs you choose
- May run programs you pick yourself.
files.user-selected.executable - Files you choose (read-only)
- May read files you pick in an Open dialog, or drag onto it, but not change them.
files.user-selected.read-only - Files you choose
- May read and change files you pick in an Open or Save dialog, or drag onto it.
files.user-selected.read-write
Network
- Local network
- Can ask to find and talk to devices on your local network.
LocalNetwork - Network extension
- May install a network extension — how a VPN, content filter or DNS proxy hooks into macOS.
com.apple.developer.networking.networkextension - VPN
- May configure and run VPN connections.
com.apple.developer.networking.vpn.api - Outgoing network
- May open connections to the internet.
network.client - Incoming network
- May accept incoming connections, acting as a server on your Mac.
network.server
Hardware
- Bluetooth
- Can ask to use Bluetooth, for example to reach headphones, a keyboard or a sensor.
BluetoothAlways - Bluetooth
- Can ask to pair with Bluetooth devices.
BluetoothPeripheral - Camera
- Can ask to use the camera.
Camera - Touch ID
- Can ask to authenticate you with Touch ID.
FaceIDUsage - Microphone
- Can ask to record from the microphone.
Microphone - Motion sensors
- Can ask to read motion sensors — almost always an iOS key left in a Catalyst app.
Motion - Screen recording
- Says it may capture the screen, as a screenshot or screen-recording tool would. macOS still asks you the first time.
ScreenCapture - Driver
- Ships a driver that runs in user space rather than in the kernel.
com.apple.developer.driverkit - Smart cards
- May talk to smart-card readers.
com.apple.security.smartcard - Audio input
- May record from an audio input device.
device.audio-input - Audio/video bridging
- May use AVB networking for professional audio hardware.
device.audio-video-bridging - Bluetooth
- May use Bluetooth from inside the sandbox.
device.bluetooth - Camera
- May use the camera from inside the sandbox. The Camera permission above is what macOS asks you about.
device.camera - FireWire devices
- May talk to FireWire devices.
device.firewire - Microphone
- May use the microphone from inside the sandbox. The Microphone permission above is what macOS asks you about.
device.microphone - Serial ports
- May talk to serial ports — an Arduino, a radio, a label printer.
device.serial - USB devices
- May talk to USB devices directly.
device.usb
Personal data
- Calendars
- Can ask to read and add calendar events.
Calendars - Contacts
- Can ask to read your address book.
Contacts - Home accessories
- Can ask to control your HomeKit accessories.
HomeKit - Location
- Can ask where your Mac is.
Location - Location always
- Can ask where your Mac is, including while the app is not in front.
LocationAlways - Location while open
- Can ask where your Mac is while the app is open.
LocationWhenInUse - Photos library
- Can ask to read your Photos library.
PhotoLibrary - Add to Photos
- Can ask to add images to your Photos library.
PhotoLibraryAdd - Reminders
- Can ask to read and add reminders.
Reminders - Speech recognition
- Can ask to send audio to Apple for transcription.
SpeechRecognition - Tracking
- Can ask permission to track you across other companies' apps and websites.
UserTracking - Contacts
- May read your address book from inside the sandbox.
personal-information.addressbook - Calendars
- May read your calendars from inside the sandbox.
personal-information.calendars - Location
- May read your location from inside the sandbox.
personal-information.location - Photos library
- May read your Photos library from inside the sandbox.
personal-information.photos-library
Other apps
- Accessibility control
- Says it may ask for Accessibility access, which lets an app read and control what is on screen. Rare in a bundle: macOS asks for this while the app runs, so most apps that use it declare nothing here.
Accessibility - Control other apps
- Can ask to send Apple Events, which is how one app scripts another — telling Finder or Safari to do something.
AppleEvents - Control other apps
- May script other apps with Apple Events. Each app it targets still needs your OK the first time.
automation.apple-events - Scriptable by others
- Names the specific apps that are allowed to script this one.
scripting-targets
System
- Siri
- Can ask to be driven by Siri.
Siri - Protected system files
- Can ask for access to system-owned files that macOS gates behind an administrator prompt.
SystemAdministration - System extension
- Can ask to install a system extension, which runs alongside macOS itself rather than inside the app.
SystemExtensionUsage - App group
- Shares a container with the developer's other apps or its own extensions — a menu bar helper and a main app, say.
application-groups - Push notifications
- May receive push notifications from its developer's server.
com.apple.developer.aps-environment - Endpoint security
- May watch what other programs on the Mac are doing. This is the security-tool API, and Apple grants it by request.
com.apple.developer.endpoint-security.client - iCloud containers
- May store data in its own iCloud container.
com.apple.developer.icloud-container-identifiers - iCloud services
- May use iCloud — document storage, key-value sync or CloudKit.
com.apple.developer.icloud-services - System extension
- May install a system extension, which runs alongside macOS itself rather than inside the app.
com.apple.developer.system-extension.install - iCloud settings sync
- May sync small settings between your Macs through iCloud.
com.apple.developer.ubiquity-kvstore-identifier - Printing
- May print.
print
Code signing
- Honours DYLD variables
- May be steered by DYLD_* environment variables, which lets a developer or a tool inject libraries at launch.
cs.allow-dyld-environment-variables - Just-in-time compilation
- May generate machine code while running. Normal for anything with a JavaScript engine, an emulator or a language runtime.
cs.allow-jit - Unsigned executable memory
- May run code from memory that carries no signature. Common in Electron apps and emulators; it switches off one Hardened Runtime protection.
cs.allow-unsigned-executable-memory - Debugger
- May attach to other processes as a debugger.
cs.debugger - Rewrites its own code
- May change its own executable pages while running.
cs.disable-executable-page-protection - Loads outside plug-ins
- May load frameworks or plug-ins signed by someone other than its developer. Typically for a plug-in system, a scripting bridge or a bundled third-party binary.
cs.disable-library-validation - Debuggable
- Lets a debugger attach to the app. Normally on only in development builds; in a shipped app it usually means a development signing profile.
get-task-allow
Identity
- App identifier
- Its signed identity: Apple team ID plus bundle ID.
com.apple.application-identifier - Associated domains
- Claims web links on domains its developer controls, so a URL can open the app.
com.apple.developer.associated-domains - Team identifier
- The Apple developer team that signed it.
com.apple.developer.team-identifier - Keychain groups
- Shares keychain items with the developer's other apps.
keychain-access-groups
Questions
Why does a Mac app need Accessibility access?
Because it needs to observe or control other applications — moving their windows, reading their menus, or sending them keystrokes. Window managers, launchers and text expanders all need it to work. It is a broad permission, and it is requested while the app runs rather than declared in its bundle.
Can I see what an app will ask for before I install it?
For most permissions, yes. The usage descriptions are shipped inside the app bundle and can be read from it, which is what this site does. Accessibility and Full Disk Access are the exceptions and appear in no bundle.
How do I revoke a permission I have already granted?
Open System Settings, then Privacy and Security, and pick the category — Files and Folders, Camera, Accessibility. Each lists the apps you have granted and lets you turn one off.
Does an app declaring the camera mean it is watching me?
No. A declaration only means the app is able to ask. macOS still prompts you, shows an indicator light while the camera is in use, and lets you revoke access at any time.