Apple turns the permission dialog into the first real AI-agent regulation — with Meta as the test case

Apple will restrict the scope of Full Disk Access in macOS, the permission that lets an app read everything on a machine. According to Geeknetic, citing Ars Technica, the change follows the controversy over Muse, Meta's assistant, which generated alerts based on a user's private conversations without explicit authorisation. The trigger was a journalist reporting that the assistant sent him a notification referring directly to a chat held in Messages.

Then came the part worth paying attention to: two incompatible accounts of what happened. Meta's chief technology officer, David Singleton, denied any technical violation and said the assistant only consults data if the owner enables two independent permissions — a specific connector inside the tool, plus the macOS disk permission. The macOS security researcher Patrick Wardle rebutted that quickly: granting Full Disk Access removes the technical barrier entirely, letting any process read chat databases, browsing history and cookies without root privileges. For the research community, the permission grants indiscriminate read access to local files regardless of which selectors an app chooses to display in its interface.

That gap is the whole story, and it is not about Meta. A toggle inside an app is a promise. An operating-system permission is a capability. Promises are enforced by the vendor's good intentions and future product decisions; capabilities are enforced by the kernel. When those two drift apart, the user is consenting to the screenshot while granting the file system.

Apple's statement to developers is unusually blunt for the company. Full Disk Access, it says, “largely bypasses” its own protections so that backup apps can work; some developers use it in ways that could put users at risk by exposing files, mail, messages and browsing history “without their full knowledge or understanding”; and in communication apps it also compromises the privacy of the people the user talks to — third parties who never saw a dialog at all. Going forward, Apple says, additional controls will mean this level of access can only be granted by explicit action. The forward-looking line is the important one: as AI agents become more capable and autonomous, the risks of that access “will increase considerably.”

Two caveats before anyone declares Apple the hero. First, the company is an interested party — it sells the platform and competes for the same assistant surface it is now fencing off, so privacy and competitive moat happen to point the same way here. That does not make the argument wrong; it does mean the remedy should be scoped APIs that third parties can actually use, not a permission only Apple's own agent can clear. Second, the permission model being patched was designed for apps that did one known thing. An agent is an app whose behaviour is chosen at runtime, partly by a model. Same checkbox, vastly larger blast radius.

Our reading: real AI governance in 2026 is being written in three places — courtrooms and state attorneys general applying existing law, procurement contracts, and now the operating system permission sheet. The third ships fastest and binds hardest, because it needs no legislature and arrives in a point release. That is uncomfortable, since it hands rule-making to a vendor, but it is also where the leverage is today. And the direction is right. The long-term promise of agents is precisely that they see enough of your life to be useful — the assistant that catches a drug interaction or spots a scam aimed at your parents needs context to do it. The answer is not to starve agents of data; it is to make consent granular, revocable and legible, so the data flows because you chose it and not because an installer needed a backup permission once. Expect broken agent workflows and friction over the next few releases. That is the correct trade while the scoped APIs catch up.