Privacy Preferences Policy Control

A dictionary whose keys are limited to the privacy policy control services. In the case of conflicting specifications, the most restrictive setting (deny) is used.

Specifies the policies for the app via the Accessibility subsystem. The ability to grant access by this profile is deprecated as of macOS 26.2, and will be removed in macOS 27.0.

—

Specifies the policies for the app to access Bluetooth devices.

—

—

—

—

—

—

—

—

Specifies the policies for the application to use CoreGraphics APIs to send CGEvents to the system event stream.

—

—

—

—

—

—

—

—

—

—

Allows the application to access data of other apps.

—

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

The identifier of the process receiving an ApplEvent sent by the Identifier process.

The type of AEReceiverIdentifier value.

Code requirement for the receiving binary.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

The 'Authorization' key is an optional replacement for the 'Allowed' key. Every payload must specify either 'Authorization' or 'Allowed', but not both. 'Allow': Equivalent to a 'true' value for the 'Allowed' key. 'Deny': Equivalent to a 'false' value for the 'Allowed' key.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used

—

The bundle ID or installation path of the binary.

The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.

Obtained via the command ''codesign -display -r -''.

If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If 'true', access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.

The 'Authorization' key is an optional replacement for the 'Allowed' key. Every payload must specify either 'Authorization' or 'Allowed', but not both. 'Allow': Equivalent to a 'true' value for the 'Allowed' key. 'Deny': Equivalent to a 'false' value for the 'Allowed' key. 'AllowStandardUserToSetSystemService:' allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization. 'AllowStandardUserToSetSystemService' is only valid for the 'ListenEvent' and 'ScreenCapture' services. Available in macOS 11 and later.

Not used.

The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.

The type of AEReceiverIdentifier value, either 'bundleID' or 'path'. This setting is required for AppleEvents service; not valid for other services.

The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.

Keys are limited to the privacy service names listed below. Each key is an array of dictionaries describing the app or process to which access is given. In the case of conflicting specifications, the most restrictive setting (deny) will be used.

The bundle ID or installation path of the binary.

The type of Identifier value.

The designated requirement describing the code signature of this executable.

If set to true, statically validate the code requirement. Used only if the process invalidates its dynamic code signature.

If set to true, access is granted. Otherwise the process does not have access. The user is not prompted and cannot change this value.

Not Used