What permissions a file shelf app should never ask for

A file shelf has a narrow job. You drop things onto it from wherever you are working, they wait there, and later you drag them off to their destination. That job touches almost nothing on your Mac beyond the files you hand it and the apps you send them to. So when a shelf asks for a permission that has nothing to do with holding and moving files, the sensible response is a raised eyebrow, not a reflexive click on Allow.

This guide walks through the permissions worth refusing, the reasons a shelf might reasonably ask for a couple of specific ones, and how to check what an app has already been granted.

The permissions that should raise a flag

Start with the network. A shelf moves files between apps on your own machine. It has no honest reason to reach the internet on its own. If a shelf wants to phone home, upload what you dropped, or check in with a server, ask why. The strongest version of this promise is an app that cannot reach the network at all, not because it chooses restraint but because it was never built with the ability. That is a claim you can verify rather than take on faith.

Next, Full Disk Access. This is the heaviest permission on a Mac. It lets an app read almost everything, including Mail’s storage, Messages, and other apps’ private data. A shelf works on the specific files you drag onto it, one at a time, by your own hand. It does not need to see your whole disk to do that. An app that demands Full Disk Access to hold a file for a minute is asking for far more than the task requires.

The camera and the microphone belong on the same list. There is no version of setting a file down on a shelf that involves your webcam or your voice. If either request appears, it is unrelated to the stated purpose, and unrelated requests are exactly the ones to deny.

Your contacts, calendar, photos library, and location round out the list. A shelf that holds a screenshot has no business reading who you know, what your week looks like, or where you are. Photos deserves a specific note. You might drag an image out of your photo library onto a shelf, but that is you exporting one picture through a normal drag, which needs no library permission at all. A request for full access to the Photos library is a different and larger thing.

The short list a shelf can reasonably need

Refusing everything is not the goal. The goal is matching each request to a real feature. A file shelf has one or two legitimate asks, and the honest ones arrive late, tied to something you just did.

Accessibility is the main one, and only for a particular trick. If you want to drop a file onto a terminal and have the shelf type the file’s path straight in, the app has to send keystrokes to another app, and macOS gates that ability behind the Accessibility permission. This is a fair trade for that specific convenience. The tell of a well-behaved app is timing. It should ask the first time you actually use the paste-a-path feature, not at launch, and it should keep working for plain drag and drop even if you say no.

A global keyboard shortcut is worth understanding too, because there are two ways to build one and they are not equal. One way listens to every keystroke system wide, which requires a heavy permission and means the app can see everything you type. The lighter way registers a single hotkey with the system and is told only when that one combination is pressed, which needs no special permission and cannot observe anything else. A shelf that opens with a shortcut should be using the second kind. If opening a shelf with a hotkey demands input monitoring over your whole keyboard, that is more reach than the feature calls for.

Beyond those, a shelf that saves your dropped items across restarts needs a place to store them, but that lives inside its own private container by default and requires no prompt directed at you.

How to check what an app already has

You do not have to guess. Open System Settings, then Privacy and Security. Each category, from Accessibility to Files and Folders to Full Disk Access, lists the apps that have been granted it, with a switch beside each one. Walk down the categories and look for anything that does not match what the app does. A shelf sitting in the Camera list is out of place. Flip it off and see if anything you actually use breaks. Usually nothing does.

For the network question specifically, the surest signal is an app that states plainly it has no networking built in and can be checked, rather than one that merely promises good behaviour. Ledge is built this way. It asks for nothing to open, it uses only a lightweight system hotkey that needs no permission, it requests Accessibility just once and only when you first paste a path into a terminal, and its release build is blocked from shipping if the binary so much as links a networking symbol. That last part turns a privacy promise into something enforced by the build itself.

The broader habit is simple and it applies to more than shelves. Read each prompt as a sentence, ask whether the permission fits the app’s actual job, and grant the narrow set that clearly does while refusing the rest. A tool that respects your Mac will ask for little, ask late, and keep working when you say no. One that asks for the network, your disk, your camera, or your contacts just to hold a file is telling you something, and the right move is to listen.