Automation (AppleScript) (Automation) is a macOS privacy permission. Automation permission lets one app control another app using AppleScript, Apple Events, or the Shortcuts framework. This means the requesting app can tell other apps to perform actions — like making Finder move files, making Safari open URLs, or making Mail send emails. Common apps that request this permission include Alfred, Hazel, Keyboard Maestro, Raycast, Default Folder X. Risk level: caution. To check which apps have this permission, open System Settings, go to Privacy & Security, and select Automation. CoreLock maps all Automation permission pairs and identifies unusual combinations — like a recently installed app that can control Mail or Messages. It flags apps with Automation access to sensitive system apps and helps you understand the potential impact of each automation pair.
Automation permission lets one app control another app using AppleScript, Apple Events, or the Shortcuts framework. This means the requesting app can tell other apps to perform actions — like making Finder move files, making Safari open URLs, or making Mail send emails.
Click the Apple menu and select System Settings.
Click Privacy & Security in the sidebar.
Click Automation. You'll see a list of apps and which other apps they're allowed to control.
Automation permissions are shown as pairs: App A can control App B. Review each pairing and ask whether it makes sense. Does Alfred need to control Finder? Probably yes. Does a random utility need to control Mail? Probably not.
Go to System Settings > Privacy & Security > Automation.
Expand each app and toggle off the specific target apps you don't want it to control. You can allow an app to automate Finder but not Mail, for example.
If you revoke a needed automation pair, the app will prompt you again when it tries to use it. You can re-approve at that time.
CoreLock maps all Automation permission pairs and identifies unusual combinations — like a recently installed app that can control Mail or Messages. It flags apps with Automation access to sensitive system apps and helps you understand the potential impact of each automation pair.
Automation lets one app control another through Apple Events (a structured API). Accessibility lets an app interact with any app's UI directly — clicking buttons, reading text, simulating input. Automation is more structured and limited; Accessibility is broader and more powerful. Both can be abused by malware.
If an app has Automation permission to control Mail.app, it can compose and send emails using AppleScript without showing you a visible compose window. This is a real attack vector — malware has used Automation to send phishing emails from victims' own accounts.
Shortcuts that interact with third-party apps may need Automation permission. Simple shortcuts using only built-in actions typically don't. If a Shortcut needs to control another app, macOS will prompt you for Automation permission the first time it runs.
CoreLock scans every app on your Mac and shows you exactly which permissions each one has. Find hidden access in under 60 seconds.
Download CoreLock FreeAvailable for macOS and Windows