← Field Notes PPPC · Deep dive

The PPPC obituaries are early: what macOS 27 actually moved off the profile

R Rob Flanagan · Jul 2026 · 4 min read

At WWDC, Apple framed the new macOS privacy model as fewer prompts for your users. That part is true. Read the schema key by key and the line it draws decides whether you migrate this cycle or run two models at once.

At WWDC this year, Apple pitched the new macOS privacy model as a convenience: one consolidated consent prompt, fewer dialogs for your users. That part is true. What the pitch skips is where the schema draws the line, and if you run security tooling that line decides whether you migrate this cycle or end up straddling two models. So I went through the configuration key by key.

This is the second piece in a short series on the macOS 27 model. The first one covered how much of the release moved onto declarative management. This one is about the part everyone is calling the death of PPPC.

There is a real declarative privacy path now

macOS 27 introduces a declarative configuration, com.apple.configuration.app.settings, that carries a Privacy dictionary of permission defaults. You set a per-app default, and on first launch the app shows one consolidated prompt covering the permissions the user hasn't already seen. It lists your org name, the app, your justification, and each permission in the set.

Read the schema and two things stand out. The prompt is a nudge, not a silent grant: Apple tuned it toward yes. In its own words from the session, "the Allow button is the default button, and is clearly highlighted." If the user picks Not Now, they fall back to the normal per-permission prompts. And on macOS this whole feature is scoped: the schema notes it applies to standard, AppKit-based Mac apps only, so background agents, daemons, and helper tools are out. There is no device-wide silent privacy grant here.

What it covers: seven permissions

On macOS the Privacy dictionary covers seven:

  • Accessibility
  • Bluetooth
  • Camera
  • Dictation
  • Local Network
  • Location
  • Microphone

Count them, because the cross-platform schema lists eight. The eighth, Location Accuracy, is iPhone and iPad only; it never shipped on the Mac. So neither platform gets the full list, and the macOS set is these seven.

What it does not cover

Full Disk Access and Screen Recording are not in the new privacy configuration this cycle. The two permissions you fight with most are simply absent from the declarative model.

That is the whole ballgame for anyone shipping an endpoint agent. If your tool needs Full Disk Access or screen recording, those grants stay on the legacy PPPC payload for now. You are not cutting over to declarative; you are running both at once. PPPC can still grant Full Disk Access. It was never able to silently grant screen recording anyway; a profile can only deny that one, or hand the choice to a standard user.

One grant path is removed. Four more are just deprecated.

This is where the "PPPC is dead" reading falls apart. In the macOS 27 TCC schema, five service keys are marked deprecated, and only one of them loses a capability you were actually using.

  • Accessibility — the one real removal. Granting it through a PPPC profile is deprecated as of 26.2 and removed in 27.0. Apple points you at the new Privacy key instead.
  • BluetoothAlways and SpeechRecognition — deprecated, with the schema pointing them toward the new Privacy key.
  • Camera and Microphone — marked deprecated, but their entries only restate what was always true: a profile can deny them, never grant them. You weren't granting these from a profile in the first place.

Full Disk Access and Screen Recording aren't deprecated at all. So the payload isn't being buried; it's being hollowed out selectively, and the one grant that actually goes away is Accessibility.

Plan for a straddle, not a cutover

If you manage Macs with security tooling, here is the shape of the next cycle:

  • Set your camera and microphone defaults in the new model for standard native apps. The user still gets the prompt; you're pre-seeding the answer.
  • Keep Full Disk Access and screen recording on the legacy PPPC payload. There is no declarative path for them yet.
  • Test the consent flow with real users before you roll it out. The prompt is built to get a yes, so make sure the yes applies the defaults you actually meant.

The obituaries are early. PPPC is narrower in 27 than it was, but it is still doing the load-bearing work for exactly the permissions your agents depend on. Next in the series: the change in the same release that I think is bigger than any of this, and that fails in a way you won't see coming. If you need to build or check a payload now, the PPPC Builder is here.

Sources

The specifics here come from Apple's own schema and session, not the summary:

← Back to Field Notes