← Field Notes
PPPC · Deep dive

The PPPC obituaries are early: what macOS 27 actually moved off the profile

R Rob Flanagan · · 5 min read

At WWDC, Apple framed the new macOS privacy model as fewer prompts for your users. That part is true. Read the schema key by key and the line it draws decides whether you migrate this cycle or run two models at once.

At WWDC this year, Apple pitched the new macOS privacy model as a convenience: one consolidated consent prompt, fewer dialogs for your users. That part is true. What the pitch skips is where the schema draws the line, and if you run security tooling that line decides whether you migrate this cycle or end up straddling two models. So I went through the configuration key by key.

This is the second piece in a short series on the macOS 27 model. The first one covered how much of the release moved onto declarative management. This one is about the part everyone is calling the death of PPPC.

There is a real declarative privacy path now

macOS 27 introduces a declarative configuration, com.apple.configuration.app.settings, that carries a Privacy dictionary of permission defaults. You set a per-app default, and on first launch the app shows one consolidated prompt covering the permissions the user hasn't already seen. It lists your org name, the app, your justification, and each permission in the set.

Read the schema and two things stand out. The prompt is a nudge, not a silent grant: Apple tuned it toward yes. In its own words from the session, "the Allow button is the default button, and is clearly highlighted." If the user picks Not Now, they fall back to the normal per-permission prompts. And on macOS this whole feature is user-scoped (allowed-scopes: [user]) and limited to AppKit-based apps. If the component that needs a permission is not AppKit-based, this feature does not cover it. There is no device-wide silent privacy grant here.

What it covers: seven permissions

On macOS the Privacy dictionary covers seven:

  • Accessibility
  • Bluetooth
  • Camera
  • Dictation
  • Local Network
  • Location
  • Microphone

Count them, because the cross-platform schema lists eight. The eighth, Location Accuracy, is iPhone and iPad only; it never shipped on the Mac. So neither platform gets the full list, and the macOS set is these seven.

Two implementation details matter when you author the declaration. None means no suggested default, not a PPPC-style deny. And a macOS PermissionDefaults identifier is composed as Bundle-ID, Bundle-ID (Team-ID), or Bundle-ID {Designated-Requirement}; it applies only when the app's code signature matches.

The same declaration also controls binaries

app.settings is not only a privacy declaration. On macOS it also carries the system-scoped AllowedBinaries and DeniedBinaries execution controls. Their identifier rules are deliberately asymmetric: an allow rule needs a CDHash or TeamID, while a deny rule can use either of those or SigningID. PathPrefix and SigningState can further narrow either rule.

What it does not cover

Full Disk Access and Screen Recording are not in the new privacy configuration this cycle. The two permissions you fight with most are simply absent from the declarative model.

That is the whole ballgame for anyone shipping an endpoint agent. In the pinned 27 seed, Full Disk Access and Screen Recording remain in the legacy PPPC payload while neither appears in declarative Privacy. Accessibility is the only entry that explicitly says its grant ability is removed in 27.0. Screen Recording remains deny-only in the profile, with AllowStandardUserToSetSystemService available to hand the choice to a standard user.

One grant path is removed. Four more are just deprecated.

The "PPPC is dead" reading falls apart right here. In the macOS 27 TCC schema, five service keys are marked deprecated, and only one explicitly says a grant capability is removed.

  • Accessibility: the one real removal. Granting it through a PPPC profile is deprecated as of 26.2 and removed in 27.0. Apple points you at the new Privacy key instead.
  • BluetoothAlways and SpeechRecognition: deprecated, with the schema pointing them toward Privacy. The new Privacy list does not contain a SpeechRecognition key, so do not assume a one-to-one migration without testing the shipped OS.
  • Camera and Microphone: marked deprecated, but their entries only restate what was always true: a profile can deny them, never grant them. You weren't granting these from a profile in the first place.

Full Disk Access and Screen Recording do not carry the 27.0 deprecation marker in the pinned seed. The safe conclusion is narrower than "everything else still grants": Accessibility alone explicitly says its grant ability is removed.

Plan for a straddle, not a cutover

If you manage Macs with security tooling, here is the shape of the next cycle:

  • Set your camera and microphone defaults in the new model for standard native apps. The user still gets the prompt; you're pre-seeding the answer.
  • Keep the legacy PPPC payload for Full Disk Access and Screen Recording while you test the 27 seed. Neither permission appears in declarative Privacy.
  • Test the consent flow with real users before you roll it out. The prompt is built to get a yes, so make sure the yes applies the defaults you actually meant.

The obituaries are early. PPPC is narrower in 27 than it was, but it is still doing the load-bearing work for exactly the permissions your agents depend on. The same release's software-update change is bigger operationally because the old path is gone rather than narrowed; Accessibility is the exception that proves the distinction. An endpoint agent's uninstall path is another reminder that its PPPC profile is only one part of a teardown. Platform SSO makes the same operational demand in a different place: test each authentication surface and its recovery path. If you need to build or check a payload now, the PPPC Builder is here.

Sources

Apple primary sources, retrieved 2026-07-29. Both schema links are pinned to the immutable macOS 27 Seed2 commit reviewed for this post:

← Back to Field Notes