Apple says it plans to introduce tighter controls around macOS Full Disk Access, a powerful permission that can allow apps to reach sensitive information stored on a user’s device. The company linked the change to the rise of increasingly capable AI agents, warning that broad access to files, messages, mail and browsing history creates new security and privacy risks.

What happened

According to Apple, macOS Full Disk Access will face additional controls because the permission can expose a wide range of user data when granted to an application. The company’s stated concern is that AI agents are becoming more capable of interacting with local systems and data, which changes the risk profile of permissions that were already highly sensitive.

At this stage, Apple has said it will add new controls, but the source does not provide full implementation details, timelines or the exact technical model. That means businesses should treat this as an announced platform change rather than a fully documented policy already in force.

Why it matters for European businesses

For many businesses, Macs are used by founders, marketing teams, developers and executives who routinely handle commercially sensitive information. Full Disk Access can potentially expose local documents, downloaded reports, browser data, mail content and other business records to software running on the device.

The practical issue is not limited to malware in the traditional sense. AI-powered desktop assistants, productivity tools and automation apps may request broad permissions in order to search files, summarise emails, draft responses or complete tasks across multiple applications. If those tools receive extensive device access, businesses may be giving a third-party application visibility into internal data far beyond what is needed for a specific workflow.

This matters in Europe because companies are under growing pressure to control data access, document security decisions and reduce unnecessary exposure of personal and commercial information. Even where no new law is created by Apple’s announcement, the direction is clear: endpoint permissions, AI tool governance and least-privilege access are becoming more important operational controls.

Who may be affected

• SMEs using Macs in daily operations: especially where local devices store contracts, financial files, customer records or internal communications.
• Marketing and creative teams: teams often adopt AI tools quickly for content, research and workflow support, sometimes before formal IT review.
• IT and security teams: administrators responsible for endpoint policies, device management and software approval may need to reassess which applications are allowed sensitive permissions.
• Founders and executives: leadership devices often contain high-value business data, making broad AI app access a governance issue as well as a technical one.
• Regulated businesses: organisations handling sensitive personal, financial, legal or health-related information should pay particular attention to local data access by AI-enabled tools.

What companies should consider

• Review which macOS apps have Full Disk Access: identify tools with broad permissions, especially newer AI assistants, automation tools and desktop productivity software.
• Apply least-privilege principles: where possible, avoid granting full-device access when a narrower permission or browser-based workflow would be enough.
• Reassess AI tool approval processes: check whether employees are adopting local AI tools outside standard procurement or IT review.
• Separate business-critical data from general desktop workflows: reducing the amount of sensitive data stored locally can limit exposure if an app receives broad access.
• Prepare for future macOS policy changes: organisations managing Apple fleets should monitor Apple documentation and test how new controls could affect existing workflows, scripts or business apps.
• Check vendor transparency: when an AI tool requests extensive system permissions, ask what data is accessed, how it is processed, whether it leaves the device and what controls exist for logging, retention and deletion.

For European businesses, Apple’s announcement is a reminder that AI adoption is not only a productivity question. It also changes how companies should think about endpoint security, software permissions and access to sensitive local data.