Guides / macOS automation permissions
macOS automation permissions: Screen Recording, Accessibility and Full Disk Access
Updated 2026-10-26 · Based on Apple’s Mac User Guide
When you run an unattended job on a cloud Mac or another remote Mac, treat requests for Screen Recording, Accessibility or Full Disk Access as questions to evaluate, not a checklist to approve. Describe what the job actually does: read a folder, capture the display, control the interface, or ask one app to operate another. macOS manages these capabilities separately, so review each permission on its own.
What each permission allows
| Setting | Apple’s description | Question to ask first |
|---|---|---|
| Screen & System Audio Recording | Allows an app to record the screen and audio, or audio only. | Does the job need pixels or sound? Could private data, code or sign-in details appear in the capture? |
| Accessibility | Allows an app to run scripts and system commands to control the Mac. | Which UI actions does it need to perform? Can the task run without controlling the whole desktop? |
| Automation | Allows an app to access and control other apps on the Mac. | Which app does the job need to control? Can you allow only the specific app relationship? |
| Full Disk Access | Allows access to all files, including data from other apps, Time Machine backups and certain administrative settings for all users. | Why is access to a named folder or the narrower Files & Folders setting insufficient? Is cross-user or cross-app access required? |
These grants are not interchangeable: permission to record the screen does not mean permission to control apps, and app control does not imply access to the whole disk. Apple’s Privacy & Security settings list requested app permissions and let you review or turn them off. Before allowing a third-party app to record the screen or audio, consider what information may be visible and review that app’s privacy terms.
Which account should run the job?
If you administer the Mac and the job can run in a separate account, consider a dedicated standard user instead of leaving recurring automation under your everyday administrator account. Apple recommends using a standard account when administrator privileges are not needed. Administrators can manage users, install or remove software and change settings; standard users cannot change other users or account settings.
A standard account narrows account-level administrative privileges, but it is not an app sandbox and does not replace reviewing privacy permissions. Apple says standard users can still install apps and change their own settings. Full Disk Access also covers certain administrative settings for all users. Check the permissions in the account that actually runs the job, not only the account you normally use.
If a job only handles files or command-line input, first test whether it can run without screen capture, Accessibility or Automation access. If it needs a GUI, grant only what its specific actions require. Handle software installation or system-wide configuration as a separate, reviewable maintenance step instead of making a persistent job an administrator by default.
A practical permission review
- Describe the job: list the files it reads, whether it captures screen or audio, and whether it controls other apps.
- Choose the narrowest matching setting: check Files & Folders for a specific directory; distinguish Automation from Accessibility when controlling apps; consider Full Disk Access only when the job needs broad file access.
- Confirm the requesting app: compare the app named in System Settings with the software you intended to run. Do not enable every permission just because one automation step failed.
- Verify under the job’s account: test one limited operation, then check whether it truly needs another permission. Keep secrets, private messages and other sensitive material out of captured screens where possible.
- Review and revoke: revisit Screen Recording, Accessibility, Automation and Full Disk Access in System Settings → Privacy & Security. Turn off grants that are no longer needed when a job is retired or changes approach.
Common questions
Does every unattended job need Screen Recording?
No. That permission lets apps record the screen or audio. If a job does not inspect visual or audio output, test whether it can run without that grant.
Are Accessibility and Automation the same permission?
No. Apple describes them separately: Accessibility lets an app use scripts and system commands to control the Mac; Automation lets an app access and control other apps. Review each against the job’s actual actions.
Does a standard account replace permission review?
No. The account type limits administrator capabilities; screen capture, app control and file access still need a task-by-task review.
This guide covers local macOS privacy permissions. For remote network entry, see the secure SSH and Screen Sharing guide. For CI workflow and runner responsibilities, see the iOS CI guide.
Sources
- Apple: Change Privacy & Security settings on Mac
- Apple: Control access to screen and system audio recording on Mac
- Apple: Set up your Mac to be secure
- Apple: Add a user or group on Mac
Apple documents the permissions macOS provides. The account and review steps here are least-privilege recommendations based on those scopes; they do not claim that any cloud Mac provider supports or configures a particular permission.