How macOS actually works

Full Disk Access, explained

Updated 2026-07-31 · 4 min read

It sounds alarming and is routinely misunderstood. Here is precisely what it covers.

What it is

A macOS privacy control. By default, apps cannot read certain protected locations even though your user account can — Mail, Messages, Safari history, Time Machine backups, and some system areas.

Full Disk Access removes that restriction for one specific app.

What it does not do

• It does not grant root or administrator rights
• It does not allow modifying /System, which SIP protects independently
• It does not permit anything at the network level
• It applies to one app, not to everything

Which apps legitimately need it

• Backup software — it has to read everything to back everything up
• Search and indexing tools — an index of "every file" is a promise you cannot keep without it
• Antivirus and security tools
• The Terminal, if you want find and ls to work everywhere without permission errors

Granting it

System Settings → Privacy & Security → Full Disk Access, then the + button, or the toggle beside an app already listed. The app must be quit and reopened afterwards — this catches people constantly, because nothing tells you and the app simply keeps failing.

Deciding

The honest test: does the app's core function require reading files it cannot currently reach? A search tool that promises to find everything genuinely does. A weather widget does not.

Distribution matters too. Because sandboxed apps cannot receive this permission, any tool that needs it must be distributed outside the Mac App Store — which is why signed, notarised direct downloads exist in this category.

Revoking

Same panel, toggle off. The app stops seeing protected locations immediately, though it may need restarting to notice.

Common questions

Is Full Disk Access dangerous?

It is a real privilege and worth granting deliberately. It does not grant admin rights, and it is per-app and revocable at any time.

Why does an app still fail after I grant it?

The app must be quit and relaunched. macOS does not apply the change to a running process.