Full Disk Access Was Never a Blank Check for an AI Agent

A permission can be technically valid and still fail to represent what a person meant to authorize. That is the problem Apple has put on the table with its announcement of additional controls around Full Disk Access in macOS. The permission was designed to let unusually privileged software, including backup applications, work across protected data. Put that authority behind an autonomous assistant and an old exception becomes a new kind of operating environment.

Apple's October 2 developer notice says some developers are using Full Disk Access in ways that expose files, mail, messages, and browsing history without users fully understanding the consequences. It also calls out the privacy of people communicating with the device owner. The company promises more explicit user action before such access can be granted. The notice does not specify a shipping date or describe the final controls. This is a stated direction, not evidence that the underlying problem has already been solved.

The important change is what software does after it receives permission. A backup program may require broad visibility to copy data according to a defined routine. An agent can use access as input to a changing sequence of judgments: infer a task, search for context, combine records, and decide what to surface. The same operating-system grant can therefore support very different behavior. A person agreeing to one useful feature may not anticipate every subsequent use that a general-purpose agent can invent.

Consider an illustrative household case. Someone gives an assistant enough access to find a receipt. The machine also contains a family member's medical discussion, an employer's confidential document, and a friend's messages. The owner's ability to expose those records through a checkbox does not establish that everyone represented in them consented to the assistant's use. Apple's reference to correspondents identifies a structural problem: access is granted per device or application, while the consequences cross relationships.

Our reading is that a stronger warning can improve consent at the point of installation, but useful agent design also requires boundaries at the point of work. A system should distinguish finding a specific receipt from maintaining a searchable memory of everything it can read. Those are separate purposes, with different retention and exposure consequences. The interface needs to make that difference intelligible before a convenience feature quietly becomes a standing collection process.

There is a real tradeoff. Assistants become more useful when they can draw connections across applications, and repeated permission prompts can make ordinary work miserable. But that does not force a choice between unrestricted access and endless interruptions. A task can carry a defined scope. A person can approve a category of recurring work. An assistant can explain when it needs to step outside that category. The difficult engineering is preserving enough continuity to help while keeping authority attached to a recognizable purpose.

A meaningful test of Apple's eventual changes will be whether a user can answer what an app may read, why it needs that access, and what happens when access is revoked. For developers, the corresponding test is whether the agent can complete a useful task with narrower authority. A product that requires the whole machine to perform a small chore has made its permission model part of the user's workload.

The announcement matters because it acknowledges a mismatch between an existing privilege and a new class of software. The next step has to make that mismatch visible in everyday behavior. An assistant should be able to explain its reach without asking its owner to study a security architecture first.