macOS 27.3 makes Full Disk Access harder to get. Here is what I would change in my Mac app
By Justinas Rolando, maker of MacPip
On October 2, 2026, Apple said that granting a Mac app Full Disk Access will soon take "very explicit user action", and pointed at AI agents as the reason. Code in the first macOS 27.3 beta, found by the researcher pdfu, stops an app that was denied a protected file from showing up in the Full Disk Access list with its switch off. People would add the app by hand with the plus button or by dragging it in. The feature flag is reportedly off in beta 1, and 27.3 is expected in December. If your app needs Full Disk Access, rewrite your onboarding now so it never depends on the app appearing in that list by itself.
If your Mac app has ever asked people to "open System Settings and turn on the switch next to our app", that sentence may stop working soon.
On October 2, Apple posted Updates to Full Disk Access in macOS on its developer news page. It's short and unusually blunt. Apple says Full Disk Access "largely sidesteps" the privacy controls so backup apps can work, that some developers use it in ways that expose files, mail, messages and browsing history without people fully understanding, and that new controls will make sure people can grant it only with "very explicit user action". The reason it gives: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."
Five weeks later, we have a first look at what that means.
What is in the macOS 27.3 beta
The first macOS 27.3 beta came out on November 3. On November 7, the code researcher pdfu posted on X about a change hidden in it, and 9to5Mac, Macworld and Cult of Mac wrote it up.
Here's how it works today. When an app without Full Disk Access tries to read a protected file, macOS says no, and then adds the app to the list in Privacy and Security, with its switch off. So the app can say "flip the switch next to us" and people find it waiting there.
With the new code turned on, macOS stops saving those denials. The app never appears in the list. People have to add it themselves, with the plus button or by dragging it in from Applications.
A few things worth knowing before anyone panics:
- It's off for now. Cult of Mac reports the feature flag, called
TCC/FDA_WARNING, is switched off in beta 1. Apple hasn't said which release it lands in. - Dragging still works. 9to5Mac and Cult of Mac both report that developers can still ask people to drag the app icon into the pane with the flag on.
- Warnings may follow. pdfu said the flag adds no new dialogs yet, but its name hints at a warning in a later beta. That would fit Apple's promise to make sure people "clearly understand these risks".
- Private Folders. The same beta has a folder-by-folder permission, set up like Full Disk Access, that isn't working yet. 9to5Mac says it could let you grant access to just the Messages folder, but how it works is unclear.
Macworld and Cult of Mac both expect macOS 27.3 in December. Everything above comes from beta code and reporting on it, not from Apple's release notes, so it can still change.
Who this hits
Plenty of good Mac apps need Full Disk Access to do their job: backup apps, which Apple names itself, plus disk cleaners, file search tools, antivirus apps and some terminal and developer tools. On MacPip that's a lot of cleanup and maintenance apps and security and privacy apps.
And then there are the apps Apple is clearly worried about: AI coding agents and assistants that read your Messages, mail or browser history to be helpful. The coverage of this change is mostly about them, and the Messages database is the example everyone uses.
If your app is in either group, the switch-in-the-list trick is the part to stop counting on.
What I would change in my Mac app
1. Ask whether you need it at all. If your app works on files people choose, an open panel and security-scoped bookmarks give you lasting access to just those folders, with no trip to Settings. Full Disk Access is for when you truly need everything, like a backup. If you only need one folder, watch Private Folders in the next betas.
2. Rewrite onboarding around dragging. Don't tell people to "find us in the list". Open the Full Disk Access pane for them, and put your app's icon in your onboarding window with a short line like "Drag this into the list". Then test that the link you use still lands in the right pane on 27.3.
3. Check for access, don't assume it. Find out whether you have it by trying to read something that needs it, and check again when your app comes back to the front. If it was removed, say so plainly instead of failing quietly.
4. Say why, in plain words. Apple wants people to understand what they are granting, and a warning may sit between your app and the switch one day. One honest sentence works better than a wall of text: what your app reads, why, and that it stays on the Mac if that's true.
5. Test on the betas now. The flag is off in beta 1, so watch beta 2 and later, and read the release notes each time. A broken onboarding usually shows up as reviews and support email, not as a crash.
If you just use a Mac
Open System Settings, then Privacy and Security, then Full Disk Access, and look at the list. Switch off anything you don't recognise or don't use any more. It takes a minute, and it's the one list on your Mac that can read nearly everything.
Today's free tool
Not about permissions, but it belongs in the same onboarding window. The new keyboard shortcut cheat sheet maker takes your app's shortcuts written any way you like, puts the modifier keys in Apple's order, and flags clashes with the ones macOS keeps for itself, like ⌘Space and ⌘Tab, and with standard ones like ⌘H. Then it gives you a sheet to print or paste into your help page. It runs in your browser.
If you're getting ready for the next macOS anyway, the get ready for the next macOS prompt walks a coding agent through the rest. And once your app is ready, listing it on MacPip is free. Listings are scanned automatically when they're submitted, and a blue tick only means MacPip checked the app on a date.
Sources
- Apple Developer: Updates to Full Disk Access in macOS (October 2, 2026)
- 9to5Mac: macOS 27.3 could change how you grant AI agents Full Disk Access
- Macworld: macOS 27.3 increases security with changes to Full Disk Access
- Cult of Mac: macOS 27.3 could make Full Disk Access harder for apps to get
- Apple Support: Mac keyboard shortcuts
- Apple Human Interface Guidelines: Keyboards
Keep reading
- Claude Fable 5.2 and Mythos 5.2: what's new, the benchmarks, and what it means for your MacClaude Fable 5.2 and Mythos 5.2 came out on November 9, 2026. Anthropic's benchmarks as charts, the prices, what changes on a Mac, and four free tools.
- Apple wrote down how App Review works. Here is what I would change before I submitApple published App Review help articles on review times, the Notes field, Bug Fix Submissions, appeals, screenshots, purpose strings and account deletion. What they say, and what I would change in a Mac app before I submit.
- The Swift Student Challenge takes Mac apps now. Here is what I would buildApple's Swift Student Challenge 2027 opens February 8 to 28 and, for the first time, takes apps for any Apple platform, macOS included. The rules, the dates, and how I would plan a Mac entry.
- macOS 27.2.1 stops curl trusting eMudhra. Here is what I would check in my Mac appmacOS 27.2.1, 26.7.3 and 15.8.3 remove five root certificates from /etc/ssl/cert.pem after the eMudhra key compromise. What changed, who it reaches, and what Mac app makers should test.
- Live Activities are coming to the Mac menu bar. Here is what I would do with my Mac appThe macOS 27.3 beta puts Live Activities in the menu bar of Apple silicon Macs, and Mac apps can start their own. What changed, the limits, and what to try first.
- Memory is making Macs dearer. Here is what I would do with my Mac appApple says memory will keep Macs short and pricier into 2027, and the cheapest Mac has 8 GB. Why that matters for your Mac app, and the checks to run this week.
- Apple now lets you talk to people who cancel. Here is what I would do with my Mac appSince November 4, App Store subscriptions can show a message or offer when someone cancels. The rules, what Apple says it does, and what to check on the Mac.
- Apple is adding two age rating questions. Here is what I would do with my Mac appFrom November 16, App Store Connect asks about shared location and dating features, and every app must answer by January 12, 2027. What changed and what to do.
- Siri AI is open to every developer now. Here is what I would do with my Mac appApple opened Siri AI to all developers in the macOS 27.3 beta. What changed, what you can and cannot ship yet, and a short plan for a small Mac app.
- Touchscreen Macs ship on November 6. Here is what I would check in my Mac appApple's first touch Macs arrive November 6. What changed, what Apple tells developers to do, and a short list of things to test in your own Mac app.
- Introducing MacPipWhat MacPip is, why I built it, how listing and launch day work, what a blue tick really means, and the real numbers from its first days.
- How to launch a Mac app: a checklist that fits on one pageWhat to do before, on and after launch day for a Mac app: signing, your page, directories, Product Hunt, Show HN and what to measure.
- How to write a one-line description that says what your Mac app doesA plain way to write the one line under your Mac app's name: name the job, cut the hype, and test it on someone who has never seen the app.
- Signing and notarization, in plain words, for people making their first Mac appWhat code signing, notarization and stapling each do, in what order, what your users see without them, and how to check your own build.
- What a dofollow link is honestly worth, from a site that offers oneWhat dofollow means, what Google says about links, why a link from a new directory is worth little today, and what to do instead of buying links.