syspolicyd is the macOS system policy daemon behind Gatekeeper: it decides whether an app may open based on its signature, notarization and where it came from; it's part of macOS and safe. It may use CPU briefly the first time you open a large new app, and if it blocks an app you trust, use Privacy & Security > Open Anyway rather than turning Gatekeeper off.
Last reviewed · 2 sources
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /usr/libexec/syspolicyd |
|---|---|
| Runs as | root |
| Signed by | Apple (Software Signing), identifier com.apple.syspolicyd |
syspolicyd implements macOS Gatekeeper — the security feature that verifies applications are from identified developers or the Mac App Store before allowing them to run. It checks code signatures, notarization status, and quarantine attributes to prevent unsigned or tampered software from executing.
Apps blocked from opening with 'unidentified developer' or 'damaged' errors
Slow first launch of new applications due to notarization check
High CPU during initial verification of large applications
Gatekeeper blocking legitimate apps downloaded from the internet
If Gatekeeper blocks an app you trust, try to open it once, then go to System Settings > Privacy & Security, scroll down to Security and click Open Anyway for that app. Apple's guide in the sources below walks through it.
Apps downloaded from the internet get a quarantine flag. If an app is incorrectly flagged, remove it with 'xattr -d com.apple.quarantine /path/to/App.app' in Terminal. Only do this for apps you fully trust from known sources.
Run 'spctl -a -vvv /path/to/App.app' in Terminal to see the detailed Gatekeeper assessment, including whether the app is notarized, signed by an identified developer, or unsigned. This helps you make an informed decision about whether to allow it.
If an app shows as 'damaged,' the download may have been corrupted. Delete the app and download it fresh from the developer's website. Corrupted downloads fail code signature verification and Gatekeeper correctly blocks them.
syspolicyd checking apps before first launch is normal security behavior. Be concerned if Gatekeeper is being silently bypassed or if you find apps running that were never approved through the Gatekeeper flow — this could indicate malware that circumvented macOS's code signing requirements.
trustd is the macOS daemon responsible for evaluating certificate trust chains. Whenever your Mac needs to verify an SSL...
sandboxd supports the macOS App Sandbox, the security technology that restricts what an app can reach (files, the networ...
tccd manages the macOS TCC (Transparency, Consent, and Control) framework — the privacy permission system that controls ...
syspolicyd is the daemon behind macOS Gatekeeper. Gatekeeper is the security feature that checks every new application before it runs to verify it's from an identified developer (code-signed) and hasn't been tampered with. syspolicyd also checks notarization status — Apple's verification that the app was scanned and approved.
macOS blocks apps that aren't code-signed by an identified developer or aren't notarized by Apple. This protects you from malware distributed as fake applications. If you trust the app and its source, you can allow it through System Settings > Privacy & Security > Open Anyway.
No. Gatekeeper is one of macOS's most important security features. Disabling it allows any software to run without verification, including malware. If you occasionally need to run unsigned software, use the per-app 'Open Anyway' option rather than disabling Gatekeeper system-wide.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser