Full Disk Access is the toggle you flip once during onboarding and never look at again. That was the whole bargain. You grant Time Machine, your backup agent, or your EDR tool the keys to the entire disk—Mail, Messages, Safari history, the lot—because sandboxing them into uselessness would defeat the point. TCC steps aside, the app reads what it needs, and nobody thinks about it until an auditor asks why your backup vendor can see everyone’s iMessage database.
Apple announced yesterday that this bargain is getting renegotiated. The developer note is short and the trigger is unusually specific: always-on AI agents—it names Meta’s Muse and OpenAI’s Dots—that sit on the machine with persistent, broad read access and never stop reading. Apple’s phrasing is that this class of software has “substantially increased the risk” associated with Full Disk Access. New controls are coming. The details are thin, which is itself the story.
Here’s why the distinction matters, and it’s the one bit Apple got exactly right. A backup agent with FDA reads your whole disk on a schedule, writes it somewhere you chose, and the risk is bounded by that one job. An AI agent with the same grant reads your whole disk continuously, interprets it, ships derived data to a model endpoint you don’t control, and keeps doing it indefinitely. Same permission. Wildly different blast radius. FDA was scoped for the first case and has been quietly load-bearing for the second for about a year now. The permission didn’t change. What’s behind it did.
What Apple actually specified is sparse. “Additional controls” on Full Disk Access on macOS, framed around persistent access rather than one-time grants. Read that as some combination of the obvious moves: periodic re-authorization so a grant doesn’t live forever untouched, clearer attribution of which process under an app bundle is doing the reading, and almost certainly more granular scoping so “the entire disk” stops being the only option on the menu. Apple has not published entitlement names, a new TCC service string, or a mobileconfig key, so I’m not going to pretend otherwise. If someone shows you a payload for this today, they’re guessing.
On timing and versions, be skeptical of anyone quoting a precise build. The note points at a future macOS release and developer betas, not something already on your fleet. Treat it as next-major-release behavior, not a point update that’s going to surprise you next Tuesday.
The part that should concern enterprise IT isn’t the AI agents. You probably haven’t deployed Muse or Dots across a managed fleet anyway. The concern is collateral damage to the tools that legitimately live on FDA: your backup software, your MDM agent’s helper, your DLP and EDR stack, sync utilities, migration tools. Every one of them holds exactly the broad grant Apple is now treating as suspicious. If re-authorization becomes periodic and user-facing, a silent grant you push via MDM today could turn into a prompt your users have to answer in six months—and the 2 a.m. version of that problem is a backup window that silently stops completing because nobody clicked “Allow.”
So the homework is boring and worth doing now. Inventory every app on your fleet holding Full Disk Access—TCC.db is the source of truth, not the Settings pane that lies to you about pending state.
Know which of those you can re-grant via PPPC payload and which depend on a human clicking a button. Ask your security vendors—bluntly—what their plan is when FDA grants stop being permanent. The ones who shrug are telling you something.
Apple is admitting out loud that a permission it designed for nightly backups got quietly repurposed as the front door for software that reads your life in real time. That’s the right call. It’s also roughly a year late, and the tools that will feel it first are the ones that were using FDA exactly as intended.