macOS

TCC (Transparency, Consent and Control)

Also called: Transparency Consent and Control · macOS privacy permissions · Full Disk Access

DefinitionTCC is the macOS subsystem behind privacy consent prompts, gating application access to categories of protected data such as Documents, Desktop, the camera and Full Disk Access.

TCC is the machinery behind every “…would like to access your Documents folder” dialog on macOS. It gates a set of protected categories — Documents, Desktop, Downloads, Photos, Contacts, Calendar, the camera, the microphone, screen recording, and the broad Full Disk Access — and records your answer per application.

It is a real, kernel-supported boundary, and it is genuinely useful. It is also the wrong shape for containing an agent, in three specific ways.

The categories miss what matters most

TCC protects the things Apple identified as privacy-sensitive to consumers. It does not protect the things that are security-sensitive to developers.

~/.ssh is not a TCC-protected location. Neither is ~/.aws, ~/.kube, ~/.netrc, your .env files, or your source repositories. They are ordinary files in your home directory, readable by any process running as you, with no prompt.

So the single most valuable target on a developer’s machine sits entirely outside the mechanism most people assume is protecting it.

The granularity is per-app and effectively permanent

TCC answers “may this application access this category”, once, and remembers. It cannot express “may this application access this file, for this task, for the next thirty minutes” — which is the shape a useful grant to an agent needs. See least privilege.

Full Disk Access is the sharpest illustration: a single toggle that grants everything, frequently requested by developer tooling, and impossible to scope. Once an agent has it, TCC has no further opinions about anything.

TCC decisions attach to an application’s identity. A child process spawned by that application is a different program, and the model does not carry a session concept the way containment sessions do.

What it is good for

None of this makes TCC bad — it is doing its job. It stops a random utility silently reading your Photos library, and it makes broad access a visible, deliberate act.

It is simply not an authority model for software whose next action is generated at runtime. For that you need something that can deny by default, cover descendants, and grant narrow exceptions with an expiry — which is AI containment, built on the authorization boundaries TCC sits alongside rather than replacing.