Every Way to Give an AI Access to Your Mac, Ranked by Blast Radius

Install any AI assistant that does more than chat and you will be handed a sequence of permission dialogs. Most people click through them in the order they appear, which is roughly the order of least thought.

They are not degrees of the same thing. macOS splits machine access into separate grants that do not imply each other, and they differ enormously in what a mistake or a compromise could reach. Here they are smallest to largest, with what each one actually unlocks.

The short version#

1. Shortcuts — the narrow one#

A Shortcut can only do what you assembled in the editor. An agent that triggers Shortcuts has an action space you defined and can enumerate, which is the whole appeal.

shortcuts list
shortcuts run "Clear Inbox"

If you are nervous about handing an assistant real power, this is the safest place to start, and it is the one I would give a nervous colleague. The ceiling is real — you cannot express "figure out which of these needs a reply" as a Shortcut — but nothing here can surprise you.

2. Apple Events — narrower than it sounds#

This is the AppleScript route, and it is the grant people are most suspicious of because the dialog says "control other applications." It is also the most tightly scoped of the real ones.

Automation is granted per pair of apps: this app controlling that app. Terminal controlling Mail is a separate grant from Raycast controlling Mail. Approving one tells you nothing about the other, and an app cannot quietly widen its own reach to a second target without asking again.

Apps that send Apple events must declare a reason string in their bundle. Apple's own Keynote says:

This will let Keynote control other applications. You can change this later in System Preferences.

Pages, Numbers, iTerm, Sublime Text, Obsidian and Zoom all ship one too. Ours reads "Jarvis uses Apple Events to control supported apps (Calendar, Reminders, Music) when you ask it to." Reading these before clicking is a genuinely good habit, because a vague one is a signal.

The practical catch is the same per-pair rule that makes it safe: a script that worked from Terminal will re-prompt when you run it from somewhere else, because that is a different pair. Most "my automation broke" reports are this.

3. Accessibility — the quiet escalation#

Accessibility exists so assistive software can operate a machine on someone's behalf. It lets an app read the interface and synthesise clicks and keystrokes into any application.

That is a much larger grant than Automation, and it does not feel like one, because the dialog is short and the apps asking for it are usually mundane — window managers, clipboard tools, text expanders. Anything with Accessibility can drive any app you have open, including ones with no scripting support at all. That is precisely why it is useful for agents and why it deserves a pause.

macOS's own Voice Control lives in this family, runs on-device, and is worth trying before you grant it to anything third-party.

4. Screen Recording — the one that sees other people#

Screen Recording is required to read what is on the display. Any agent that answers "what am I looking at" needs it.

Its blast radius is wider than it looks for a reason that has nothing to do with your files: you are also capturing other people. A shared screen in a video call, a colleague's message, a customer's record. Where those frames go — the device, a provider, a training set — is the question to ask, and the answer should be in writing before you grant it.

Ours is scoped by intent: "Jarvis captures the current screen only when you explicitly ask it to summarise or look at what's in front of you." Whether an app honours its own string is not something the OS enforces, which is why this grant deserves more scepticism than the Automation one everybody worries about.

5. Full Disk Access — the one people click through#

This is where the ranking usually surprises people. Full Disk Access is broader than Automation, broader than Accessibility, and asks for far less justification in the moment.

It reaches the protected stores other apps rely on: Mail's message database, Messages history, Time Machine backups, Safari data, and the per-app containers in your Library. Not "files you opened" — the whole protected set.

You can watch it work. macOS protects its own permission database with it, so without the grant, even listing that directory fails:

ls ~/Library/Application\ Support/com.apple.TCC/
# ls: ...: Operation not permitted

That is the same wall standing between an app and your mail store. Prefer the narrower folder permissions where an app offers them — Desktop, Documents and Downloads are separate grants, and an assistant that only needs to read a file you point at does not need the whole disk.

6. Shell execution — no dialog at all#

Here is the one with no permission prompt, because it is not a permission.

If you let an assistant run shell commands, it runs them as you. Everything your account can reach, it can reach: your repositories, your SSH keys, your cloud CLI credentials, ~/.aws, ~/.config. There is no macOS dialog for "may I run arbitrary commands," and there is no System Settings pane listing which apps do.

That is not an argument against it. Shell access is what makes an agent able to do real work, and I would not use an assistant that could not. It is an argument for knowing that this is the grant you made, and for preferring tools that sandbox it. Open Interpreter runs commands inside native sandboxing for exactly this reason.

The failure mode to think about is not the model turning malicious. It is the model being wrong, or being talked into something by text it read in a file or a web page, and having a shell to be wrong with.

7. The one that is not a Mac permission#

Everything above is bounded by one machine. Take the laptop away and the access goes with it.

Connected accounts are not like that. When you connect Gmail, Calendar, Slack or Notion — through OAuth or MCP — you issue a token that reaches that account from anywhere, by any process holding it, whether or not your Mac is even on. It is the largest thing most people grant and the only one with no macOS dialog, no Privacy & Security pane, and no local revoke.

Revoke these at the provider: Google's account permissions page, Slack's app management, and so on. And when you evaluate an assistant, the scopes it asks for tell you more than any privacy page. Read-only calendar is not the same request as full mailbox access, and a tool asking for the second to do the first is telling you something.

We wrote more about what agents do with that reach in what a real Mac agent looks like.

Auditing what you have already granted#

Open System Settings → Privacy & Security and read down the list. Each category is a separate pane with its own set of apps. The ones worth a slow scroll are Accessibility, Screen Recording, Full Disk Access and Automation, in that order of "things I do not remember approving."

From the terminal, tccutil resets a category:

tccutil reset ScreenCapture com.example.app   # one app
tccutil reset Accessibility                   # every app, for that service

Two things to know. Omitting the bundle id resets that permission for everything, which is a bigger hammer than most people intend. And grants are tied to an app's code signature — ours is signed under a Developer ID — so a rebuild under a different identity is a different app as far as macOS is concerned, and starts over.

The rules I would actually apply#

1. Grant in the order of the work, not the order of the dialogs. If an assistant asks for Full Disk Access before it has done anything useful, make it wait.
2. Prefer the narrow grant when both would work: folder permissions over Full Disk Access, Automation over Accessibility, Shortcuts over shell.
3. Read the reason string. It is one sentence and vendors write it themselves. Vague is a signal.
4. Treat connected accounts as the serious one. It is the grant that outlives the machine.
5. Re-audit after you stop using something. Uninstalling an app does not revoke what you gave it, and the entry stays in the list.

We build Jarvis, which asks for several of these — Apple Events for Calendar, Reminders and Music, microphone for voice, screen capture on request, and folder access for files you point it at. It is open source, so the honest version of "trust us" is that you can go and read what each one is used for.