What Is Full Disk Access on Mac? Who Needs It

Quick answer: Full Disk Access is a macOS permission that lets an app read files macOS otherwise protects, such as your Mail, Messages and Safari data. Backup tools and some security tools need it, most other apps don't, and you can check and remove it in System Settings > Privacy & Security > Full Disk Access.

It is probably the most powerful permission you can grant an app on your Mac, and the one people understand least. Here is what it grants, which apps should have it, and how to check yours.

What Full Disk Access Actually Grants

When you give an app Full Disk Access (FDA), you're handing it a lot more than the documents in your home folder. It lifts most of the privacy protections macOS puts around your personal data.

Here's what apps with FDA can access:

Your entire Mail database lives in ~/Library/Mail/. That includes every email you've ever received, sent, or drafted. Your Messages conversations are stored in ~/Library/Messages/. Your Safari browsing history and bookmarks become accessible too. Saved passwords are not: they stay encrypted in your keychain, which Full Disk Access doesn't unlock.

Time Machine backups on a connected drive are fair game too, including older versions of files you thought you'd deleted.

Here's the thing though — regular file access permissions don't work this way at all.

How Full Disk Access Differs from Regular File Access

Most Mac permissions follow Apple's concept of "least privilege." When you give an app access to your Photos library, it can only see photos. When you grant Camera permission, the app can capture new images but can't read your existing photo files.

Full Disk Access throws this principle out the window. It's a binary choice: either the app can read almost nothing protected, or it can read almost everything.

The technical reason involves macOS's System Integrity Protection (SIP) and the Transparency, Consent, and Control (TCC) framework. Normally, TCC prevents apps from accessing certain protected directories without explicit permission. You can see these restrictions in the TCC database at /Library/Application Support/com.apple.TCC/TCC.db.

When an app has Full Disk Access, it can read the files TCC protects. It's like having a master key to your data. It doesn't grant the camera, microphone or screen recording, though: those are separate permissions.

Apps That Legitimately Need Full Disk Access

Some applications genuinely require this level of access to function. Backup software is the obvious example.

Carbon Copy Cloner, ChronoSync, and Arq all need FDA to create complete system backups. They have to read Mail databases, Safari data, and system files to do their job properly. Without FDA, these apps would create incomplete backups that might fail to restore your system correctly.

System maintenance tools often need it too. Disk space analyzers ask for it so they can measure folders macOS protects.

Some development tools legitimately need it. Terminal is the common one: developers grant it so command-line tools can read protected folders. Code editors might ask for it for certain debugging scenarios, though it's worth being cautious unless you're actively developing system-level software.

Security tools present an interesting case. Malware can hide in protected folders, so a scanner that looks there needs FDA. CoreLock asks for it so it can read the permission database macOS keeps: with it, CoreLock's Privacy report lists apps granted Screen Recording, Accessibility, Full Disk Access and Input Monitoring, alongside camera and microphone.

Apps That Definitely Don't Need Full Disk Access

Note-taking apps, photo editors and games sometimes ask for Full Disk Access too. There's rarely a legitimate reason for this.

Text editors like Sublime Text or Atom don't need FDA to edit code files. Neither do photo editors like Pixelmator Pro or Affinity Photo. These apps can function perfectly well with standard file access permissions.

Social media apps requesting FDA should immediately raise red flags. There's no reason Instagram, Twitter, or TikTok needs to read your email database or Messages history. Same goes for music apps — Spotify doesn't need full disk access to play songs.

Browser extensions can't hold Full Disk Access themselves: they run inside the browser's sandbox. If an extension's setup asks you to grant your browser Full Disk Access, be suspicious.

How to Check Which Apps Have Full Disk Access

You can see which apps have this permission in System Settings > Privacy & Security > Full Disk Access. One gap in Apple's implementation: it doesn't tell you when these apps last used the permission.

Grants also pile up. An app you allowed once for a feature you used once keeps the permission until you remove it. Once you give CoreLock Full Disk Access, its Privacy screen lists which apps hold Full Disk Access, along with camera, microphone and other grants. The list in System Settings shows the same thing, and it's where you turn access off.

You can also check the TCC database directly from Terminal:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client,service,auth_value FROM access WHERE service='kTCCServiceSystemPolicyAllFiles';"

This shows which apps have asked for Full Disk Access and whether it's on (auth_value 2) or off (0). The kTCCServiceSystemPolicyAllFiles is Apple's internal identifier for FDA. Terminal needs Full Disk Access itself to read this file, even with sudo.

The Hidden Risks Most People Don't Consider

Here's something most articles won't tell you: apps with FDA can potentially access data from other applications, even if those applications have their own privacy protections.

For example, that backup app with Full Disk Access could theoretically read your 1Password data files, your VPN logs, or your cryptocurrency wallet files. These apps store data in protected directories specifically to prevent other applications from accessing them.

FDA essentially breaks this isolation model.

There's another risk that's harder to quantify. Apps with FDA can monitor file system changes across your entire Mac. They can see when you create new files, modify existing ones, or delete sensitive documents. This creates a detailed profile of your computer usage patterns.

Making Smart Decisions About Full Disk Access

The key is being ruthless about which apps actually need this permission. A simple approach:

Start by asking whether the app's core functionality requires reading system-level data. For backup software, the answer is obviously yes. For a note-taking app, it's almost certainly no.

Consider the app developer's reputation and privacy practices. Established companies with clear privacy policies are generally safer bets than indie developers or companies with questionable data handling practices.

Check whether the app offers specific explanations for why it needs FDA. Legitimate apps usually explain exactly which protected directories they need to access and why. Vague requests like "to improve performance" should be red flags.

When You Should Revoke Full Disk Access

Review the apps that have FDA every few months. If you haven't used an app in months, revoke the permission. You can always re-grant it later if needed.

Apps that have been acquired by new companies deserve special scrutiny. That innocent backup utility you trusted two years ago might now be owned by a data broker. Privacy policies can change, and Full Disk Access permissions don't expire automatically.

If an app starts requesting FDA after an update, that's worth investigating. Why does the new version need system-level access when the old version didn't?

The Gatekeeper Problem

Here's something that might surprise you: Gatekeeper, Apple's app verification system, doesn't prevent apps with FDA from accessing sensitive data inappropriately. Gatekeeper checks that apps are signed by registered developers and scans for known malware, but it doesn't audit how apps use granted permissions.

An app could have a completely clean Gatekeeper signature while still misusing Full Disk Access to collect data you never intended to share.

This is honestly where I think Apple's current approach falls short. The permission system assumes users will make informed decisions about FDA requests, but most people don't understand what they're granting access to.

A Reality Check

To be completely honest, this is probably overkill for casual Mac users who primarily use mainstream apps from the Mac App Store. App Store apps undergo additional review processes that make permission abuse less likely (though not impossible).

But if you're a developer, work with sensitive data, or install apps from outside the Mac App Store, being selective about Full Disk Access becomes much more important.

I might be overly cautious here, but I'd rather err on the side of protecting your privacy than assume every app developer has good intentions.

The Future of Full Disk Access

Apple has been gradually tightening permission controls with each macOS release. Sequoia introduced new restrictions on screen recording permissions, and I expect FDA will eventually get similar treatment.

The challenge is that some applications genuinely need broad system access to function. The trick is finding a middle ground between security and functionality.

For now, though, Full Disk Access remains an all-or-nothing permission. That makes your decisions about which apps to trust even more critical.

Understanding what permissions your Mac apps have isn't just about privacy — it's about maintaining control over your own data. Full Disk Access might be the most powerful permission on macOS, but it doesn't have to be the most dangerous if you're thoughtful about how you grant it.