Summary
- Full Disk Access can expose files, mail, messages, browsing history, and other private information.
- Apple plans to require more explicit user action before applications receive that level of access.
- The company says increasingly autonomous AI agents make broad permissions more consequential.
As artificial intelligence agents gain greater autonomy over software and data, Apple is preparing additional controls around Full Disk Access in macOS to make unusually broad application permissions harder to grant without explicit user action.
Full Disk Access allows software to reach information that would otherwise sit behind macOS privacy controls, partly because applications such as backup tools need unusually wide access to function. Apple says the same permission can expose files, mail, messages, browsing history, and other information without users fully understanding the extent of that access.
Under the planned changes, granting the permission will require a more explicit action from the user, although Apple has not yet published the full technical design or deployment timetable for the new control.
Its developer notice directly connects the change with increasingly capable and autonomous AI agents, whose ability to take actions on a person’s behalf can enlarge the consequences of a permission originally designed around more conventional applications.
Autonomy changes how permissions are used
Traditional desktop controls largely assume that a person can judge an application by the task it performs and decide whether the requested access seems proportionate, while an autonomous agent may determine its own intermediate actions after permission has already been approved.
Where an agent can search files, inspect messages, read browser information, and invoke other software, information from several sources can be combined during a task even though the operating system technically granted only one broad permission.
Communication software creates an additional privacy boundary because mail and messages contain information about correspondents who never saw or approved the permission request. Apple specifically notes that broad access can therefore affect the privacy of people communicating with the user as well as the person operating the Mac.
Removing Full Disk Access altogether would prevent legitimate software from performing functions that depend on it, so Apple is instead changing the process through which applications receive the permission.
The shift reflects a wider problem emerging around agentic software: controls designed to govern what an application may access do not necessarily explain what increasingly autonomous software will decide to do once that access has been granted.
By changing how macOS handles one of its broadest permissions, Apple is beginning to adapt the desktop security model around that difference rather than treating AI agents as if their behaviour were identical to traditional applications.
