Apple said on October 2 that it would introduce additional controls around Full Disk Access in macOS. The developer notice warned that some apps were using the permission in ways that could expose files, mail, messages, and browsing history without a user's full understanding.
Full Disk Access is unusually broad because it helps backup software reach material that ordinary app permissions protect. Apple also noted that a communication app's access can affect the privacy of the people its user talks to.
An assistant's setup permission can apply beyond the next visible task, including access to material belonging to other apps.
Read the request against the job
Before granting an app broad access, ask what it needs to do with the data.
- A backup tool may need to copy material across many folders. Check the developer's explanation of what is included and where copies go.
- A single document task has a narrower purpose. Look for a file picker or another way to choose the material involved.
- An app that connects to messages can encounter information about other people. Consider that before treating the contents as an ordinary test file.
Inspect what the Mac currently allows
Apple's Privacy & Security guide describes Full Disk Access as access to all files, including data from other apps and Time Machine backups. It lists Files & Folders, Accessibility and Automation as separate controls with different purposes.
Open System Settings, choose Privacy & Security and inspect the permission relevant to the task. The settings shown on your installed version are the practical starting point. Use the version selector in Apple's guide if its instructions do not match your computer.
| Permission | What Apple's guide describes |
|---|---|
| Files & Folders | Access to files and folders in specified locations |
| Full Disk Access | Broad file access, including other apps' protected data |
| Accessibility | Running scripts and system commands to control the Mac |
| Automation | Accessing and controlling other apps |
Review one app against one job
Check which feature requires the permission in the developer's documentation before changing a setting that supports a backup or another important ongoing task.
For a document task, see whether selecting the particular file provides the required access. For a backup task, confirm the intended sources and destination. Removing access required by a backup can prevent it from working.
If you change a permission, check whether the intended task still works and record what you changed. Keep work-device changes within your organization's support process. That record is useful if a later failure requires you or a support person to reconstruct the configuration.
An app can need more than one type of permission. Reading a protected file, controlling another app and carrying out system commands are different capabilities in Apple's settings. A successful document export does not show that the app needs all three. Conversely, a failed backup after a change may mean the backup's required access was removed.
Avoid changing several permissions together, because a resulting failure will be harder to trace. On a managed Mac, ask the administrator responsible for the configuration.
Apple's wording described controls it would introduce going forward. It did not give a universal release date in this notice. Keep that announcement separate from the permissions actually shown by the version of macOS installed on your computer.
A folder permission can be sufficient for a folder job
Apple's Files & Folders instructions describe controls for particular locations such as Desktop, Documents and Downloads. That gives a practical comparison with Full Disk Access. A utility sorting downloaded receipts may have a reason to reach Downloads without needing the protected data of unrelated apps.
A backup program has a different purpose because omitting protected folders can leave its copy incomplete. The developer should identify those sources and the consequence of withholding access. The name of the permission alone cannot tell you whether a completed backup contains everything you expected.
File access and subsequent handling also belong to different decisions. A macOS setting controls what the app can reach on the computer; Apple's instructions say third-party collection is governed by that party's terms and privacy policy. For a cloud-connected utility, read where the developer says the files go. Revoking local permission later does not by itself explain the status of copies already transferred to another service.
