AppPermitHow to control which files an app can access on Mac
macOS asks the first time an app touches Desktop, Documents or Downloads — but only for those fixed locations, and “allow” is permanent. If you want an app to be read-only, or to ask before touching a specific folder, you need finer control.
Where the built-in permissions stop
- Only fixed locations: Desktop, Documents, Downloads, removable volumes. Project folders and repositories are not covered.
- Just allow or deny — no read-only.
- No record of what an app actually read or wrote.
AppPermit’s file permission model
AppPermit offers four options under Global Control › File permissions and in each app’s detail page, enforced locally by a system extension:
| Option | Meaning |
|---|---|
| Read & write | Read, write, delete, rename and run programs — effectively unrestricted. |
| Read-only | Read and run programs, but no modifying, deleting or creating files. |
| Ask | Prompt before the first read or modification of a folder; programs may still run. |
| Custom combination | Mix the behaviors above as needed. |
Note that read-only does not stop programs from running; it restricts file changes. This is a common misunderstanding.
Folder rules: more specific wins
- Under File permissions › Folders, click “Add folder…”.
- Pick a directory and set its access level, for example
~/Projectsto “Ask”. - When rules overlap, the more specific folder takes priority over the global default. Enforced restrictions always apply and cannot be loosened by ordinary rules.
See what an app actually touched
Activity lists recent file operations and program launches grouped by source app, with each decision (allowed, blocked, asked). From a suspicious record you can jump to that app’s settings or ask the AI what it means. Some records may be omitted under heavy load.
FAQ
Do file permissions apply to Apple’s own apps?
Apple apps are trusted and hidden by default; you can change the “Trust and hide Apple” option in Settings.
Will “Ask” prompt constantly?
Prompts are per folder: once on the first read or modification of a folder, then handled by your choice. It does not ask for every file.
Does this slow down file access?
Rules are evaluated locally by the system extension; there is no noticeable difference in daily use. Activity records are trimmed under heavy load to protect performance.
7-day full trial · $14.99/yr or $29.99 lifetime · macOS 14+