Entitlements explainer
Paste what codesign prints, or your .entitlements file. It is read right here on this page, and nothing is sent anywhere.
Try an example:
What it does
Entitlements are the permissions your Mac app is signed with: whether it runs in App Sandbox, which folders and devices it can reach, which hardened runtime protections it switches off, and which Apple services it uses. They live in your .entitlements file and end up inside the signature. This tool reads the text you paste, finds each entitlement and its value, and says in plain words what it allows. It puts the ones that will stop notarization first, then the ones App Review or a careful user will ask about, then the ordinary ones.
Commands to run
codesign -d --entitlements - YourApp.app codesign -d --entitlements - --xml YourApp.app
Run them on the build you ship. A Debug build from Xcode usually carries com.apple.security.get-task-allow, which a Release build does not. To check a helper or an extension, point the command at that bundle instead.
What each result means
| Mark | What it means |
|---|---|
| Fix | Notarization rejects it, or macOS will not run a third-party app with it. |
| Look | A hardened runtime exception, a sandbox exception, a sandbox that is off or a test setting. Allowed, but keep it only if the app needs it. |
| OK | App Sandbox is on. |
| Note | An ordinary permission. Check the app really uses it. |
Sources: Apple Developer, Entitlements, App Sandbox, Hardened Runtime and Resolving common notarization issues, all read November 6, 2026.
How it works
It is a few plain text rules running on this page. It reads the XML that an .entitlements file or codesign --xml holds, and the bracketed [Key] and [Value] lines that codesign prints on recent macOS. If you paste only key names, it explains those. It knows about 50 common entitlements. Anything else it marks as not in its list instead of guessing. It cannot tell whether hardened runtime is turned on, because that is a signing flag rather than an entitlement: look for flags=0x10000(runtime) in what codesign -dv prints.
Questions
What are entitlements on a Mac?
They are permissions written into an app's code signature. They say whether the app runs in App Sandbox, which files, devices and Apple services it can use, and which hardened runtime protections it turns off.
How do I see an app's entitlements?
Run codesign -d --entitlements - followed by the path to the app in Terminal. Add --xml to get the same list as a property list.
Why was my app rejected by notarization for get-task-allow?
That entitlement lets debuggers attach, and Xcode adds it to Debug builds. Archive a Release build, or remove it from the entitlements you sign with, then submit again.
Does a Mac app need App Sandbox?
Only for the Mac App Store, which requires it. An app you sell yourself with Developer ID can run without it, though it still needs hardened runtime for notarization.
Is what I paste sent anywhere?
No. The text is read on this page and nothing is sent.