One toggle. That is the entire architectural distance between an AI agent running on a Mac and every protected file on the machine. Full Disk Access on macOS is not a gradient, not a scope, not a lease. It is a binary grant, and once it flips, it stays flipped.
On October 2, 2026, Apple posted a note to its developer site saying that is going to change. The company plans to introduce additional controls around Full Disk Access to make sure users actually understand what they are agreeing to before they agree to it. TechCrunch framed the move as a response to new risks from AI agents. AppleInsider and Daring Fireball both report the same core change: clearer consent, with the risks made more apparent at the moment of granting. Apple has not said when the controls ship.
The short version of the story is a privacy tightening. The more interesting version is a statement about permission models built for one kind of software being handed to a fundamentally different kind.
Permissions assume a program that knows what it wants
Apple’s own framing of Full Disk Access is instructive. The permission exists, per Apple, to let backup apps function properly on the Mac. That is a telling design origin. A backup utility has a fixed, inspectable, essentially static purpose. It reads files and writes them somewhere else. Its behavior next Tuesday is the behavior you approved today. The consent dialog works because the thing asking for consent has a stable intent.
An agent does not have a stable intent. Its behavior at any moment is a function of a model’s policy, a system prompt, a tool registry, conversation history, and whatever text happens to arrive from a web page, a document, or an email thread. Approving Full Disk Access for an agent is not approving a behavior. It is approving a capability that will be composed at runtime by inputs nobody has seen yet.
That is the actual asymmetry Apple is reacting to. The consent model binds a permission to a binary. The risk model needs to bind a permission to an intent. Those have not been the same thing since agents started shipping with filesystem tools.
Why this matters more than it sounds
Consider what Full Disk Access reaches on a typical developer’s Mac:
- Mail stores, message databases, and browser history
- SSH keys, cloud credentials, and config directories holding API tokens
- Local repository checkouts, including anything in a
.envfile - Time Machine backups and the sync folders of other services
Now consider that an agent with read access to that set also typically has a network tool. Read plus egress is the whole exfiltration pipeline in two capabilities, and neither of them looks malicious in isolation. The agent that summarizes your inbox and the agent that leaks your inbox require the same permission grant. Only the instruction differs, and the instruction can come from untrusted content the agent was asked to process.
What a better model looks like
Apple’s stated fix is about comprehension at the point of consent, which is a reasonable first move and a limited one. Making users understand the risk is necessary. It is not sufficient, because comprehension at grant time does not constrain behavior at run time.
The architecture that actually addresses this looks less like a checkbox and more like a capability system. A few properties worth designing toward:
- Scoped grants. Access to a directory, not a disk. Agents rarely need everything, and the ones that claim to usually have not thought about it.
- Time-bound leases. Permission that expires with a task rather than persisting for the lifetime of an install.
- Per-tool attribution. Logs that record which tool call read which path under which user request, so a review is possible after the fact.
- Egress separation. Treating “can read sensitive files” and “can make arbitrary network calls” as permissions that should be hard to hold simultaneously.
None of that requires Apple. Agent developers can build scoped file tools, path allowlists, and audit trails today, and the serious ones already do. Requesting Full Disk Access because it makes onboarding easier is a design decision, and it is one that is about to get more expensive to defend in a consent dialog that spells out the stakes.
The real signal
Apple has not disclosed a rollout date, so the practical details are still open. The direction is not. A platform vendor has looked at an existing permission and concluded that agentic software breaks the assumptions it was built on. That is a quiet but meaningful admission: the trust primitives of the desktop were specified for deterministic programs, and agents are not that.
Every operating system, browser, and runtime that hands broad capabilities to software based on a single install-time approval has the same gap. Apple is simply the first large vendor to say so in writing about one of its own permissions. Expect the rest of the industry to arrive at the same conclusion, probably with less warning and worse dialog copy.
🕒 Published: