Reading a macOS permission prompt before you click Allow
· 5 min read
macOS asks before an application can reach your camera, your files, your screen or your keyboard. The prompts appear during first use, when you are trying to get something done, which is exactly when people click Allow without reading.
They are not equivalent. Some are routine; two of them hand over effectively total access.
The ones that matter most
Screen Recording. Lets an application see everything on your display, continuously. Every window, every document, every password visible on screen.
Legitimate for video conferencing, screenshot tools and screen recorders. If anything else asks, ask why. This is the most powerful grant on the list.
Accessibility. Lets an application control your Mac: read the contents of windows, send keystrokes, click things, drive other applications.
Legitimate for automation tools, window managers, text expanders and genuine accessibility software. It is also the grant malware most wants, because it allows reading window contents and simulating input. Treat a request from anything unexpected with real suspicion.
Those two are the ones worth stopping for. Everything else is narrower.
The rest
Full Disk Access. Reaches protected locations: Mail data, Messages, Safari history, Time Machine backups. Backup software and some maintenance tools need it. Most applications do not.
Files and Folders. Scoped to Documents, Desktop, Downloads or removable volumes. Reasonable for an application that opens files, and it is granted per location rather than wholesale.
Camera and Microphone. Self-explanatory. macOS shows an indicator whenever either is active, which cannot be suppressed. Auditing which apps can see your camera and microphone covers reviewing them.
Location. Rarely necessary on a Mac. Location services on a Mac covers who asks.
Automation. Lets one application control another, for example a script driving Mail. Narrower than Accessibility and worth reading, since it names both applications.
Input Monitoring. Reads keyboard input outside the application. Legitimate for shortcut tools. Otherwise, a keylogger by another name.
Three questions before clicking Allow
Did I just ask for this? If you clicked “start recording” and it asks for Screen Recording, the request matches the action. A prompt appearing out of nowhere does not.
Does the function need this? A text editor asking for Accessibility is odd. A window manager asking is expected.
Do I know what this is? If the application name is unfamiliar, deny and investigate. Denying is reversible; granting and forgetting is how permissions accumulate.
Reviewing what you have granted
Worth doing occasionally, because grants persist and applications get updated, sold, and repurposed.
System Settings, Privacy & Security. Work down the list: Accessibility, Screen Recording, Full Disk Access, Input Monitoring, Automation. Remove anything you no longer use or do not recognise.
Nothing breaks permanently. If an application needs a permission you revoked, it will ask again.
Why permissions get revoked on their own
macOS re-evaluates when an application’s signature changes, so an update can reset a grant. Applications will ask again, which is expected rather than a fault.
This also means an application behaving oddly after an update is often a revoked permission rather than a bug. A menu bar app is missing after a macOS update covers that pattern.
The wider point
Permission prompts are the main place where you decide what software can do on your machine, and they arrive at the worst possible moment for careful thought.
The habit worth building is small: read the application name and the permission being asked for, and check they make sense together. Two seconds, and it is the difference between a considered decision and a reflex.
Software that genuinely needs little is worth preferring. An application that asks for nothing cannot misuse anything, and there is no permission to revoke later.
Questions
Can I grant a permission temporarily? No, grants persist until revoked. Revoking afterwards is the equivalent.
Why does an app work without asking? Because it needs nothing protected. Plenty of software operates entirely within its own sandbox.
What if I deny and the app breaks? Grant it later in System Settings. Nothing is permanent.
Is Screen Recording needed for screenshots? For taking a screenshot with the built-in tool, no. For an application that captures the screen itself, yes. That is the distinction worth watching.