Privacy Preferences Policy Control

com.apple.TCC.configuration-profile-policy

The payload that configures privacy preferences.

macOS 10.14+

Not available with User Enrollment · macOS: device channel only

Configuration Keys (1)

Key	Type	Description	Default	Range
`Services`dict Services required	dict	A dictionary whose keys are limited to the privacy policy control services. In the case of conflicting specifications, the most restrictive setting (deny) is used.	Default: —	Range: —
`Accessibility`array Accessibility macOS · deprecated 27.0 deprecated	array	Specifies the policies for the app via the Accessibility subsystem. In macOS 27.0, the device shows a non-blocking notification for each application when this setting is applied, and it allows the user to make changes to the setting in the System Settings app. Deprecated: use the 'Privacy' key in the declarative management 'com.apple.configuration.app.settings' configuration.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow (deprecated 26.2, removed 27.0) (Allow), Deny (Deny)
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AppleEvents`array AppleEvents	array	Specifies the policies for the app sending restricted AppleEvents to another process.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`AEReceiverIdentifier`string AEReceiverIdentifier required	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string AEReceiverIdentifierType required	string	The type of AEReceiverIdentifier value, either 'bundleID' or 'path'. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: Bundle ID (bundleID), Path (path)
`AEReceiverCodeRequirement`string AEReceiverCodeRequirement required	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`BluetoothAlways`array Bluetooth Always macOS 11.0+ · deprecated 27.0 deprecated	array	Specifies the policies for the app to access Bluetooth devices. Deprecated: use the 'Privacy' key in the declarative management 'com.apple.configuration.app.settings' configuration.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`Calendar`array Calendar	array	Specifies the policies for calendar information managed by the Calendar.app.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`Camera`array Camera macOS · deprecated 27.0 deprecated	array	A system camera. A profile can't grant access to the camera; it can only deny it.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AddressBook`array Contacts	array	Specifies the policies for contact information managed by the Contacts.app.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`FileProviderPresence`array macOS 10.15+	array	Allows a File Provider application to know when the user is using files managed by the File Provider.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`ListenEvent`array macOS 10.15+	array	Allows the application to use CoreGraphics and HID APIs to listen to (receive) CGEvents and HID events from all processes. A profile can't grant access to these events; it can only deny it.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Deny': Access is denied. 'AllowStandardUserToSetSystemService': Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization.	Default: —	Range: Deny, AllowStandardUserToSetSystemService
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`MediaLibrary`array macOS 10.15+	array	Allows the application to access Apple Music, music and video activity, and the media library.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`Microphone`array Microphone macOS · deprecated 27.0 deprecated	array	A system microphone. A profile can't grant access to the microphone; it can only deny it.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`Photos`array Photos	array	The pictures managed by the Photos app in '~/Pictures/.photoslibrary'.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`PostEvent`array PostEvent	array	Specifies the policies for the application to use CoreGraphics APIs to send CGEvents to the system event stream.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`Reminders`array Reminders	array	Specifies the policies for reminders information managed by the Reminders app.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SystemPolicyAllFiles`array SystemPolicyAllFiles	array	Allows the application access to all protected files, including system administration files.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`ScreenCapture`array Screen & System Audio Recording macOS 10.15+	array	Allows the application to capture (read) the contents of the system display. A profile can't grant access to the contents; it can only deny it.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Deny': Access is denied. 'AllowStandardUserToSetSystemService': Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization.	Default: —	Range: Deny, AllowStandardUserToSetSystemService
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SpeechRecognition`array Speech Recognition macOS 10.15+ · deprecated 27.0 deprecated	array	Allows the application to use the system Speech Recognition facility and to send speech data to Apple. Deprecated: use the 'Privacy' key in the declarative management 'com.apple.configuration.app.settings' configuration.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SystemPolicyDesktopFolder`array Files and Folders: Desktop Folder macOS 10.15+	array	Allows the application to access files in the user's Desktop folder.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SystemPolicyDocumentsFolder`array Files and Folders: Documents Folder macOS 10.15+	array	Allows the application to access files in the user's Documents folder.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SystemPolicyDownloadsFolder`array Files and Folders: Downloads Folder macOS 10.15+	array	Allows the application to access files in the user's Downloads folder.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SystemPolicyNetworkVolumes`array Files and Folders: Network Volumes macOS 10.15+	array	Allows the application to access files on network volumes.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SystemPolicyRemovableVolumes`array Files and Folders: Removable Volumes macOS 10.15+	array	Allows the application to access files on removable volumes.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SystemPolicySysAdminFiles`array System Policy Sys Admin Files	array	Allows the application access to some files used in system administration.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SystemPolicyAppData`array System Policy App Data macOS 14.0+	array	Specifies the policies for the app to access the data of other apps.	Default: —	Range: —
`IdentityDict`dict	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: bundleID, path
`CodeRequirement`string required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`SystemPolicyAppBundles`array App Management macOS 13.0+	array	Allows the application to update or delete other apps.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary. Note: This value is case-sensitive.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtain this value by running 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string Authorization macOS 11.0+	string	The 'Authorization' has one of the following possible values: 'Allow': Access is granted. 'Deny': Access is denied.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —
`Allowed`boolean	boolean	If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value. > Note: > Every payload needs to include either `Authorization` or `Allowed`, but not both.	Default: —	Range: —
`AEReceiverIdentifier`string	string	The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`AEReceiverIdentifierType`string	string	The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services.	Default: —	Range: bundleID, path
`AEReceiverCodeRequirement`string	string	The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services.	Default: —	Range: —
`RemoteDesktop`array Remote Desktop	array	Allows the application to control the computer remotely. Available in macOS 14.7 and later.	Default: —	Range: —
`IdentityDict`dict required	dict	A dictionary listing apps and the privacy policy to apply to them.	Default: —	Range: —
`Identifier`string Identifier required	string	The bundle ID or installation path of the binary.	Default: —	Range: —
`IdentifierType`string Identifier Type required	string	The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.	Default: —	Range: Bundle ID (bundleID), Path (path)
`CodeRequirement`string Code Requirement required	string	Obtained via the command 'codesign -display -r -'.	Default: —	Range: —
`StaticCode`boolean StaticCode	boolean	If 'true', statically validate the code requirement. Used only if the process invalidates its dynamic code signature.	Default: false	Range: —
`Authorization`string	string	The 'Authorization' key is an optional replacement for the 'Allowed' key, which has one of the following possible values: 'Allow': Equivalent to a 'true' value for the 'Allowed' key 'Deny': Equivalent to a 'false' value for the 'Allowed' key Note: Every payload needs to include either 'Authorization' or 'Allowed', but not both. Available in macOS 14.7 and later.	Default: —	Range: Allow, Deny
`Comment`string Comment	string	Not used.	Default: —	Range: —