Apple to Require Explicit Consent for macOS Full Disk Access

Apple's developer news site posted a notice on October 2 stating that macOS will add controls requiring more explicit user action before an app gets Full Disk Access. The company names the reason directly: AI agent risk. No ship date is attached, and no beta, no build number, no affected macOS version is named in the notice. That gap matters. Full Disk Access is the permission that lets an application read Mail, Messages, browser histories, and other users' files; it is also exactly the permission an autonomous AI agent needs to act on a person's behalf across apps.

Full Disk Access already requires a manual trip to System Settings, a toggle most users grant once and forget. Apple's notice implies that flow is no longer sufficient once software can request and use that access without a human initiating each task. The mechanism Apple is pointing at is consent timing. If an AI agent can chain together permissions it was granted for one job and apply them to another, a single approval starts covering far more ground than the user understood at the time they clicked yes. Tightening that requires either repeated prompts, scoped grants, or some new confirmation step tied to the agent's specific action rather than the app's installation.

For IT managers overseeing Mac fleets, the stakes sit in configuration management. Full Disk Access is frequently pre-approved through mobile device management profiles for backup tools, endpoint security software, and automation scripts. If Apple's new controls require fresh, explicit per-action consent rather than a one-time profile grant, those silent MDM approvals may stop working, breaking workflows that assume unattended access. Apple's notice does not say whether MDM-granted permissions are exempt. That is the first thing a sysadmin should confirm once Apple publishes technical details, because the answer determines whether this is a user-facing prompt change or a fleet-wide policy rewrite.

Workers who use AI agents on their own Macs face a smaller but real shift: tasks that currently run quietly in the background, like an agent indexing local files to answer a question, may start interrupting with permission dialogs. That is friction, not prohibition, but friction changes adoption. A worker who has to approve five prompts to let an agent search their downloads folder may simply stop using the feature. Policy watchers should note that Apple is acting unilaterally here, through a developer notice rather than a public comment process, which means the shape of the eventual control is entirely at Apple's discretion until it ships.

What Apple has not disclosed leaves open several practical questions. There is no detail on whether the new consent step applies retroactively to apps already holding Full Disk Access, whether it distinguishes between human-initiated and agent-initiated requests, or whether third-party AI tools get the same treatment as Apple's own. Developers building Mac agents should watch for a WWDC session or a follow-up developer bulletin, since Apple typically pairs permission changes like this with new APIs that let apps request narrower, task-specific access instead of the current all-or-nothing grant.

Until Apple publishes an SDK or a beta build, the October 2 notice is a statement of intent, not a technical specification. The one fact on record is the citation of AI agent risk as the reason, a rare instance of Apple naming the threat model behind a security change rather than describing the change alone.