Apple has quietly tightened the rules governing full-disk access on macOS, according to Ars Technica. The change targets a specific concern: AI agents that, once granted broad filesystem permissions by a user, were able to leverage that access in ways that went well beyond what most people would have anticipated or intended.
To understand why this matters, it helps to understand what full-disk access actually means on a Mac. Introduced as a formal permission category with macOS Mojave in 2018, full-disk access was Apple's answer to growing concern about applications reaching into sensitive areas of the filesystem — mail archives, browser history, backup files — without users realizing it. An application with that permission can, in principle, read almost anything stored on the machine. When Apple designed that system, the adversary it had in mind was a rogue or poorly written app. The threat model was relatively static: an app asked for permission, a user granted or denied it, and that was largely that.
AI agents change the calculus considerably. An agent is not a passive application waiting to be invoked. It is, by design, a system that takes sequences of actions autonomously, often chaining together tasks in ways its operators did not explicitly script in advance. When a user grants an AI agent full-disk access — perhaps because a setup wizard asked for it, or because the agent genuinely needs access to local files to perform some useful function — that permission can become a remarkably powerful capability in the hands of a system that is actively deciding what to do next. The agent can read files to inform its decisions, pass that information to a language model, and act on the results, all without the user being present for each discrete step. This is not necessarily malicious, but it is a meaningful expansion of what "granting access" has historically implied.
The broader context here is that the AI agent ecosystem has grown rapidly, and the platforms underneath it — operating systems designed years before agents were a practical reality — have not always kept pace. Apple, Microsoft, and others are all navigating a version of the same problem: permission systems built around the assumption of discrete, human-operated applications are poorly suited to software that acts more like a semi-autonomous employee than a tool. On macOS in particular, the permission model has become increasingly granular over the years, with separate gates for camera, microphone, location, contacts, and so on. But granularity alone does not help if the agent can satisfy its goals through one very broad permission.
The likely reading of Apple's change is that the company is trying to introduce more friction or more specificity into what full-disk access means when the entity holding it is an agent rather than a conventional application. This suggests Apple may be distinguishing between an application having a capability and an agent being able to exercise that capability autonomously at scale. Even a modest constraint — requiring re-authorization for certain sensitive directories, or flagging when an agent is actively traversing the filesystem in unusual patterns — would represent a meaningful philosophical shift in how the operating system thinks about trust.
For developers building AI agents that run on macOS, the consequences could be significant. Workflows that currently rely on broad filesystem access may need to be restructured to request narrower, more specific permissions. This increases the engineering burden but also, arguably, forces a more honest conversation with users about what the software actually needs to do. For end users, the change is likely to be a net positive, though it may come with some short-term friction as agents they already use run into new walls and require updated permissions or redesigned flows.
For Apple itself, the move fits a long-standing pattern. The company has consistently used its control over the platform layer to assert privacy and security standards that it then markets as differentiators, sometimes ahead of regulatory requirements and sometimes in ways that frustrate developers while pleasing privacy advocates. Doing so in the context of AI agents also positions Apple as a responsible steward of the agentic future it is simultaneously trying to sell, a tension the company will need to manage carefully as its own AI ambitions expand.
What to watch for next is whether Apple formalizes this into explicit developer guidance and whether it signals a new permission category tailored specifically to agent behavior. It will also be worth watching how competitors respond — if Apple's approach proves effective and popular with users, pressure on Microsoft and others to introduce similar constraints on Windows and their own AI platforms will grow. The deeper question, which no operating system maker has fully answered yet, is how to build a permission model adequate for software that can decide, on its own, what to do with the access it has been given.
