Apple has decided to tighten restrictions on one of macOS's most sensitive permissions. The company has notified developers that it will add extra controls to Full Disk Access, an authorization that allows a program to read a significant portion of the computer's data. The trigger, according to Apple, is the arrival of artificial intelligence agents capable of navigating the system and accessing personal data. There is no specific date or macOS version for the change yet.
The decision hasn't been in vain. Doubts about Muse, Meta's assistant for Mac, and the ease with which broad permissions are granted have brought desktop privacy into sharp focus. Apple maintains that certain programs are using this key in a risky way. The idea is that granting full disk access will no longer be a mechanical process.
Apple makes a move regarding full disk access
Full disk access has been a feature of macOS for years, originally designed to allow backup utilities like Time Machine to function without encountering standard security controls. When granted, this permission allows an application to access files, mail, messages, Safari data, Home information, and backups, as well as certain administrative settings. This is no small permission: it bypasses a significant portion of the system's privacy settings.
In practice, the user must go to System Settings, then Privacy & Security, and manually add the application to the Full Disk Access list. This mechanism is intended for exceptional cases, but Apple believes some developers are requesting it for functions that go far beyond backups. The company wants whoever authorizes it to know exactly what they are opening.
The announcement was published in the developer forum, without naming the affected apps or providing a rollout schedule. Apple argues that AI agents are becoming increasingly capable and autonomous, and that the danger of such broad access will rise significantly. The company also warns that, in communication apps, exposure could extend to the people the user is communicating with. Files, email, messages, and browsing history are all at risk if permission is granted without understanding its implications.
What changes and what remains up in the air
The permission isn't disappearing. What's changing is the friction: Apple will require clear and deliberate action from the user before granting that level of access. The app will no longer automatically inherit trust, and the user will have to make a decision again. This is a consent barrier, not a removal of the feature.
In enterprise-managed systems, a way to remotely control these permissions already exists. The Privacy Preferences Policy Control payload allows IT administrators to specify which applications can access the disk, which cannot, and what signing requirements they must meet. When multiple policies are applied, the system uses the most restrictive one. This makes it easy to revoke or limit all disk access on fleets of Macs without relying on manual review.
Important questions remain. Apple hasn't specified when the change will arrive or in which version of macOS it will be implemented. Nor has it detailed how it will integrate with business workflows or whether it will affect legitimate utilities and AI agents equally. The company has chosen to set the course before revealing the technical details.
The Muse case and the controversy with Meta
The most talked-about incident has a name. Journalist Jason Aten of Inc. reported that Muse, Meta's assistant for Mac, seemed to know the content of his messages even though he didn't recall giving explicit permission. The case was later picked up by other tech outlets and reignited the question of how far an agent can go once it's installed on a desktop. The line between authorized and inferred access has become quite blurred.
Meta rejected that interpretation. Its spokesperson, Andy Stone, maintained that access to Messages is entirely optional and that both Full Disk Access and the specific Messages connector must be enabled. The company argues that Muse cannot read these conversations without the user's permission. The disagreement makes it clear that the problem is not only technical, but also one of perception and trust.
The Muse issue isn't the only open front. A Wired report indicated that a vulnerability in the ChatGPT application for Mac could have been used to access sensitive data, including conversations and browser sessions. While not all cases have the same scope, they all point to the same area of ​​risk: programs that reside on the computer and handle sensitive information. AI agents expand what can be done, but also what can be lost.
What can the user do in Spain?
To check the system status, the first step is to open System Settings and review Privacy and Security. Under Full Disk Access, you'll find a list of authorized applications. It's worth checking which programs are listed, whether they're still necessary, and if their presence is justified. Regular review is a simple measure and prevents the retention of outdated permissions.
In Europe, this discussion aligns with a growing demand for informed consent and data restriction. For businesses and freelancers, knowing which tools have broad access on their Macs is crucial. If agents are used for automated tasks, it's essential to keep environments separate and avoid mixing personal data with evidence. The convenience of delegating tasks should not take precedence over maintaining control over information.
Apple's move also has implications for software developers. Requesting maximum permissions by default can create a trust issue if the user doesn't understand why they're necessary. Offering options by folder, data type, or specific function reduces the feeling of having free rein. An agent that explains its needs has an easier time gaining permission.
What's on the table is a change in macOS policy: full disk access will still exist, but it won't be so easy to grant or forget. Apple hasn't set a date, Meta denies any misuse of Muse, and experts continue to point out risks in desktop AI tools. The practical takeaway for users is to review permissions and be wary of authorizations requested without explanation. Privacy on the Mac increasingly depends on reading before accepting.