spctl and Gatekeeper: Manage App Security on Mac

Every time you open a downloaded app, Gatekeeper decides whether it runs — checking the developer's signature and Apple's notarization before macOS lets it launch. spctl is the command-line window into that system: it reports the current policy and can assess any app the way Gatekeeper would. What it can no longer do, as of recent macOS versions, is loosen the rules.

Check Gatekeeper's status

# is Gatekeeper evaluating apps?
spctl --status

assessments enabled is the healthy answer, and the one virtually every Mac should return. It corresponds to System Settings → Privacy & Security → Allow applications from being set to "App Store" or "App Store & Known Developers". assessments disabled means Gatekeeper is off globally — if you didn't do that deliberately and recently, treat it as a finding worth fixing (more below).

Assess an app like Gatekeeper would

Before double-clicking a download you're unsure about, ask spctl what Gatekeeper thinks of it:

# evaluate an app bundle (-a assess, -vv verbose)
spctl -a -vv /Applications/SomeApp.app

Three outcomes you'll see:

• accepted · source=Notarized Developer ID — signed by a registered developer and scanned by Apple's notarization service. The normal result for legitimate non-App Store software.
• accepted · source=App Store — installed from the Mac App Store.
• rejected — unsigned, unnotarized, or the signature is broken. Not proof of malware, but exactly the case Gatekeeper exists to slow down.

The assessment is read-only — it changes nothing about the app or your settings, so it's a safe habit for anything downloaded from the open web.

What changed in recent macOS versions

For years, power users ran sudo spctl --master-disable to reveal an "Anywhere" option under Allow applications from. That era is over:

• Ventura and Sonoma: the command still works and adds "Anywhere" to the settings pane. The undo is sudo spctl --master-enable, which restores the default policy and removes the option.
• Sequoia: Apple removed the ability — spctl can no longer disable Gatekeeper globally, and macOS 15 also dropped the old Control-click → Open shortcut for bypassing a block. The supported path is per-app approval in System Settings.

If you ran --master-disable on an older install (often at some tool's insistence) and the Mac has been upgraded since, run spctl --status today and re-enable if it still says disabled.

The safe way to open a blocked app

When you trust a specific app that Gatekeeper rejects, approve that one app instead of weakening the whole policy:

1. Double-click the app and let the block dialog appear. Click Done, not Move to Trash.
2. Open System Settings → Privacy & Security and scroll to the Security section — you'll see "SomeApp" was blocked.
3. Click Open Anyway and authenticate. On Sequoia this is the only supported bypass; on Sonoma and Ventura it also works alongside the (now retired) Control-click trick.

The approval applies to that app alone, survives updates to it in most cases, and leaves Gatekeeper fully armed for the next download — which is the entire point.

One connection worth understanding: Gatekeeper assesses apps that carry the quarantine flag, the marker browsers attach to downloads. That's why an app copied from a USB stick may launch without ceremony while the same app downloaded in Safari gets inspected. You can see the flag with xattr -p com.apple.quarantine /Applications/SomeApp.app; our guide to the quarantine attribute covers when removing it is reasonable and when it defeats the point. Assessments also cover installer packages: spctl -a -vv -t install thing.pkg asks the same question of a .pkg before you hand it your administrator password.

Gatekeeper's bigger sibling

Gatekeeper guards what launches; System Integrity Protection guards macOS itself, even from root. Our guide to SIP and csrutil covers that second layer.