TCC, short for Transparency, Consent, and Control, is the macOS privacy framework that decides whether an app may access protected resources such as the camera, microphone, screen contents, contacts, photos, certain folders and the ability to control other apps. Within macOS security & privacy, it is the mechanism behind the familiar permission prompts and the Privacy & Security pane of System Settings.
TCC protects user data even from software that runs under the user’s own account. Traditional Unix permissions would let any program launched by a user read that user’s files; TCC adds a second, consent-based layer on top, so an app must be explicitly approved before it reaches sensitive data, and the user can revoke that approval at any time.
How TCC decides on access
TCC is enforced by a system daemon, tccd, which the operating system consults whenever a process touches a protected service. The daemon identifies the requesting app by its bundle identifier and code signature, checks stored decisions, and either allows access, denies it or shows a consent prompt to the user.
Decisions are stored in SQLite databases: a system-wide database for machine-level services and a per-user database in the user’s Library folder. The system database is protected by System Integrity Protection, so even the root user cannot edit it directly. Each record includes a code requirement, which prevents a different, unsigned binary from impersonating an approved app.
Apps must also declare purpose strings in their Info.plist, such as a reason for camera use. If the string is missing, macOS terminates the app instead of showing a prompt, which ensures that every request is accompanied by an explanation for the user.
Services protected by TCC
The list of protected services has grown with almost every macOS release since macOS Mojave, which extended consent prompts well beyond contacts and calendars. The table groups the most important ones.
| Service | What it protects | How access is granted |
|---|---|---|
| Camera and microphone | Video and audio capture | Prompt on first use |
| Screen and system audio recording | Capturing other apps’ windows and sound | Toggle in System Settings, periodic reconfirmation |
| Full Disk Access | Mail, Messages, Safari data, Time Machine backups | Manual addition in System Settings only |
| Files and folders | Desktop, Documents, Downloads, removable and network volumes | Prompt per location |
| Accessibility | Controlling the user interface of other apps | Manual toggle in System Settings |
| Input Monitoring | Reading keyboard and pointer input from all apps | Manual toggle in System Settings |
| Automation | Sending Apple events to control another app | Prompt per app pair |
| Contacts, Calendars, Reminders, Photos | Personal data stores | Prompt on first use |
Location Services look similar to users but are handled by a separate subsystem, and some services, such as Full Disk Access, deliberately cannot be requested by a prompt, because a single careless click would expose too much data.
TCC compared with other macOS protections
TCC is one layer in a stack of macOS defenses, each answering a different security question. Confusing them leads to wrong troubleshooting, for example trying to fix a camera prompt by changing Gatekeeper settings.
| Protection | Question it answers | When it acts |
|---|---|---|
| TCC | May this app access this private resource | At the moment of access |
| Gatekeeper | May this downloaded app launch at all | At first launch |
| App notarization | Has Apple scanned this software for malware | Before distribution, checked at launch |
| SIP | May anyone modify protected system files | Continuously, even for root |
| App Sandbox | Which resources does the app declare it needs | Defined at build, enforced at runtime |
| XProtect | Does this file match known malware | At launch and during scans |
The protections reinforce each other. TCC relies on code signing to recognize apps reliably, and SIP protects the TCC database itself, so weakening one layer, such as disabling SIP, also weakens TCC.
Managing TCC in organizations
In managed fleets, administrators pre-approve permissions with a Privacy Preferences Policy Control profile, delivered through mobile device management. The profile targets an app by bundle identifier and code requirement and can grant services such as Full Disk Access or Accessibility, which security and backup agents typically need.
Some decisions remain reserved for the user by design. MDM cannot silently grant camera or microphone access, and screen recording can only be denied or delegated to standard users, not granted outright. These limits stop an organization from covertly enabling surveillance on a device.
| Task | Tool | Note |
|---|---|---|
| Pre-approve an endpoint agent | PPPC profile through MDM | Requires supervised or user-approved enrollment |
| Reset a broken permission | tccutil reset with service and bundle ID | App prompts again on next use |
| Review granted access | Privacy & Security pane | Lists apps per service |
| Investigate denials | Unified log filtered on tccd | Shows the process and the service |
Limitations and common pitfalls
TCC grants permissions to the responsible process, which can surprise users. Giving Full Disk Access to Terminal effectively gives it to every script run from Terminal, so the safer practice is to grant access to the specific tool that needs it.
- Prompt fatigue leads users to approve requests without reading them.
- Re-signed or updated apps with a changed code requirement can lose their permissions.
- Malware abuses approved apps by injecting into or scripting them, which is why Hardened Runtime and Automation prompts matter.
- Historical bypasses have been found and patched, so keeping macOS updated is part of TCC’s effectiveness.
Stripped to the essentials
TCC is the part of macOS that asks for your permission before an app can use your camera, microphone, photos, contacts or personal folders. It works like a receptionist at a front desk: an app must ask, you decide, and the decision is written down.
You can change your mind later in Privacy & Security in System Settings. Even if an app is already running on your Mac, it cannot quietly read your messages or record your screen unless you have allowed it.
Where it is applied
A design agency manages 60 Macs with an MDM service and installs a new backup agent. On the first night, backups of the Mail and Desktop folders fail, and the unified log shows TCC denials for the agent. The IT administrator deploys a PPPC profile granting Full Disk Access to the agent’s bundle identifier and code requirement.
The next backup completes without user prompts. When employees start using a video conferencing app, the administrator cannot grant camera access centrally, so each user approves the camera once at the first call. One user who accidentally denied access fixes it in System Settings. The outcome is a fleet where essential agents work silently while personal sensors stay under user control.