Apple said on Friday that it’s adding new controls around Full Disk Access on macOS, the permission that hands an app your files, Messages history, Mail, and browsing data in one click. The stated reason, reported first by TechCrunch and picked up by The Verge, is AI agents: software that now acts on your machine rather than waiting for you to drive it. Apple’s framing is that the new controls should ensure users who genuinely want to grant this level of access can only do so deliberately.
Good. Also: this problem did not start with agents.
One switch, everything behind it
Full Disk Access has been the crude end of macOS privacy controls for years. Camera and microphone and contacts each get their own gate. Your entire home directory, including the SQLite database holding every text message you’ve sent, gets one. Backup utilities need it. Some terminal emulators ask for it. Plenty of apps request it because asking once is easier than handling narrower permissions properly, and users click through because the alternative is an app that doesn’t work.
The security math never favored that design. What changed is who’s on the other side of the switch. A human-driven app with Full Disk Access reads what the human tells it to read. An agent with Full Disk Access reads whatever its instructions resolve to, and those instructions can come from a web page, a PDF, or an email body that the agent was helpfully asked to summarize. Prompt injection turns a permission grant into a standing offer.
Deliberate friction is the whole fix
Apple’s language points at consent flow rather than capability: make the grant harder to give by accident. That’s the right instinct and a thin one. A scarier dialog slows down the user who skims. It does nothing for the user who genuinely meant to grant access to an agent that later gets talked into exfiltrating ~/Library/Messages/chat.db.
The version of this that actually holds is scoped and revocable. Per-directory grants. Time-boxed access that expires. An audit trail showing what an app with Full Disk Access actually touched, which macOS does not surface today in any usable form. Apple has the architecture for this; TCC already does fine-grained prompts for Desktop, Documents, and Downloads. Full Disk Access is the escape hatch that bypasses all of it.
There’s a commercial angle worth naming. Apple is also the company shipping AI features into the OS, and a permission model that makes third-party agents look dangerous is not an unwelcome side effect. Anthropic, OpenAI, and a crowd of smaller desktop-agent startups all want the broad access Apple is about to make harder to obtain. Apple’s own system-level access isn’t gated behind the same dialog.
Two things Apple’s update doesn’t settle: which macOS release carries the change, and what happens to the Full Disk Access grants already sitting in System Settings for apps you installed in 2022 and forgot about. Check that list. Mine had four entries I couldn’t justify.