Apple is changing one of macOS’s broadest privacy permissions because AI agents have made desktop access harder to understand and easier to misuse. In a new developer announcement, Apple says it will introduce additional controls around Full Disk Access, a permission that can expose files, mail, messages, and browsing history to an app.
The important shift is not simply that Apple is tightening a setting. It is that the company is treating autonomous software as a different kind of risk from traditional utility apps.
Full Disk Access was built for utilities. AI agents changed the calculation.
Full Disk Access exists largely so backup software and similar tools can function across a Mac. That broad permission was already powerful, but the user’s mental model was relatively simple: a utility needed to inspect a lot of files in order to do its job.
Apple now says some developers are using the permission in ways that could expose everything on a user’s system “without users’ full knowledge and understanding.” That includes personal files, email, messages and browsing history. For communication apps, Apple adds, the exposure can also affect the privacy of people who are communicating with the user.
AI agents complicate the old permission model because they are not just reading data to perform one narrow task. They can interpret information, make decisions, take actions and potentially pass context between tools. A permission granted to an app can therefore become permission for a much wider chain of behavior than the user originally imagined.
That is why Apple’s language matters. The company calls Full Disk Access an “extraordinary level of access” and says users who genuinely want to grant it should have to take “very explicit user action.” The change is about making consent harder to miss, not necessarily making broad access impossible.
The next AI interface will be shaped by permission friction.
This is a useful correction to the idea that better AI products simply need more context. Desktop agents become more capable when they can see more of a user’s digital life, but that capability also makes vague consent unacceptable. The more an agent can infer from messages, files and browsing history, the less convincing a one-time permission toggle becomes.
Apple’s move also shows where responsibility is moving. Users still decide whether to grant access, but platforms are increasingly expected to make the consequences legible before that decision is made. The interface is becoming part of the security model.
For AI developers, that creates a product constraint rather than a minor compliance task. Asking for broad access at setup may no longer be enough. Agents will need to explain what they can see, why they need it and what actions may follow. The best permission experience may become a competitive advantage because it makes an agent feel controlled rather than mysteriously omniscient.
The tension is especially sharp for apps that promise personal assistance. Those products need intimate context to be useful, yet the same intimacy can make an accidental or misunderstood permission feel like surveillance. Recent reporting around desktop AI apps has made that concern more visible, but Apple’s response points to a longer-term change in product design.
AI agents are moving from chat windows into the operating system. Once they can act across a person’s files, messages and apps, trust cannot remain a vague promise in a privacy policy. It has to be built into the moment when access is granted, with enough friction to make the decision real.