Mac Permission Prompts Explained: What to Allow

"App would like to control this computer using accessibility features" is one of the more alarming sentences macOS produces, and it appears when you install perfectly ordinary software. Here is what each permission actually grants, which ones deserve a pause, and how to take them back.

Where they all live

Every permission you have granted is listed in System Settings → Privacy & Security, one category per section. You can revoke any of them at any time, and the app finds out when it next tries to use it. Worth going through once a year; the list grows quietly.

Accessibility — high trust

Despite the name, this grants an app the ability to control your Mac: move windows, click things, read the interface, send keystrokes. It is what window managers, automation tools, text expanders and remote support software genuinely need.

It is also broad. An app with Accessibility access can do most of what you can do. Grant it to tools you chose deliberately and recognise, and be sceptical when something you did not expect asks.

Screen Recording — the highest risk

Anything with this can see everything on your screen, continuously, including passwords as you type them into a form. Video call apps, screenshot tools and menu bar managers all legitimately need it — menu bar apps ask because reading the menu bar counts as reading the screen.

Review this list more carefully than any other. If you no longer use an app on it, remove it.

Full Disk Access — broad but specific

Grants an app access to protected areas: Mail, Messages, Safari data, Time Machine backups and other users' folders. Backup software, some developer tools and antivirus need it. Very little else does.

A short list here is a healthy sign. If something asked for it and you cannot remember why, revoke it and see whether anything breaks — the app will tell you if it genuinely needed it.

Input Monitoring — the one to question

Lets an app see your keystrokes even when it is not the frontmost app. Legitimate for text expanders, shortcut tools and some game controllers. It is also exactly what a keylogger needs, so this is the prompt to think hardest about.

Automation — narrower than it sounds

"App wants to control App B" grants scripting access between two specific apps. It is per pair, so the list is long and each entry is limited. A script that fills a spreadsheet from Mail needs this and it is entirely normal. You can revoke each pairing individually.

The everyday ones

• Camera and Microphone — self-explanatory, and hardware indicators back them up: the green light beside the camera cannot be faked in software, and an orange dot in the menu bar means the microphone is live.
• Files and Folders — per-folder access to Desktop, Documents and Downloads. Granting an app access to one folder rather than Full Disk Access is the better shape when it is offered.
• Location Services — check System Services → Details at the bottom, where several system features are on by default.
• Local Network — needed for anything discovering devices on your Wi-Fi, such as a printer utility or a media player.

When a prompt keeps coming back

An app asking repeatedly usually means the permission was granted to a different version or a different copy of the app. macOS ties permissions to the app's signature and location, so an app in Downloads and the same app in Applications are two different entries, and an update that changes the signature resets the grant.

The fix is to remove the entry in Privacy & Security, make sure only one copy of the app exists and that it lives in Applications, then grant it again. If you need to reset a category completely, macOS has a command for it:

# reset one category for one app, then grant again cleanly
tccutil reset ScreenCapture com.example.app

# reset a whole category for every app (heavy handed)
tccutil reset Accessibility

Use the per-app form. The second version makes every app ask again, which is a long afternoon.

How to decide, in five seconds

1. Did you just do something that would need it? A prompt that arrives while you are setting up a screen recorder makes sense. One that arrives out of nowhere does not.
2. Do you recognise the app by name? The prompt names the app, and helper processes sometimes have unfamiliar names — check what they belong to before allowing.
3. Is a narrower permission available? Folder access beats Full Disk Access every time.
4. You can always say no. Denying is not permanent; the app will ask again, or you can grant it later in Privacy & Security once you have decided.