What applications may do.
WHAT SANDBOXING IS
Restricting an application to its own container and explicitly permitted resources.
WHERE IT IS MANDATORY
Applications distributed through the store.
WHERE IT IS OPTIONAL
macOS applications distributed directly, though notarisation is still required.
WHAT AN ENTITLEMENT IS
A declared capability, signed into the application.
WHAT COMMON ENTITLEMENTS COVER
Network access, incoming or outgoing File access, to selected locations Camera, microphone and location Notifications Sign-in services Payments Background modes
WHAT THE PRINCIPLE IS
Request the minimum your features require.
WHAT REQUESTING MORE COSTS
Review scrutiny, and user suspicion.
WHAT SECURITY-SCOPED ACCESS PROVIDES
Continued access to a file the user chose, across launches.
WHY THAT MATTERS
Without it, a sandboxed application loses access when it restarts.
WHAT TO KNOW ABOUT SYSTEM EXTENSIONS
They require specific entitlements Apple grants selectively.
WHAT TO ESTABLISH EARLY
Whether your intended capability is permitted at all.
WHY
Building something that cannot be shipped is an expensive discovery.
