Why did Apple change Full Disk Access for AI agents?

The receipts, dated

The real problem Apple's move names

The autonainews write-up states the core problem in one sentence worth keeping verbatim:

That is the entire failure mode. A backup tool and a file-sweeping agent hold the same permission; the difference is in the action pattern, and permission systems don't score patterns. Apple's fix detects the behavior class — "any shift toward autonomous agent behaviour triggers a new consent request" — and re-asks. That's a consent upgrade. But consent, re-asked once, is still consent: after the user re-taps "Allow," the 3 a.m. sweep of ~/Documents + Messages DB + browsing history still passes every check, because every read is still technically authorized. Apple detects the class; nobody scores the instance.

What Apple gated — and what it didn't

This slots directly into September's authorization arc: the six-bank report (Sept 22) demanded "transparency over how AI agents make decisions" and auditable records; the FTC's rogue-agent probe (Sept 30) needs instruction/authority/intent/outcome on every consequential decision (why this matters). Fleischer's four questions — what the agent can see, what it can send, what it can change, who can reconstruct its actions afterward — are the gate's record shape. Apple's notice answers none of them for any specific action.

Proof: two actions, two receipts, minted today

We scored two macOS file-access scenarios against the live decision gate (local-heuristic-v1, bands ≥0.80 auto / 0.50–0.79 confirm / <0.50 escalate) on October 5, 2026 ~09:31 EDT:

Exact request shape, so you can mint your own:

curl -s -X POST https://scriptmasterlabs.com/api/harness/decide \
  -H "Content-Type: application/json" \
  -d '{"state":{"context":"macos-fda-trendhunt-2026-10-05"},
       "questions":[{"id":"q1","type":"score","scale":[0,1],
       "question":"Should a file-organizer app holding Full Disk Access
        sweep ~/Documents, the Messages database, and browsing history at 3am
        and upload a zip to an unnamed external server?"}]}'

Do it yourself: add the per-action layer (5 steps)

1. Stop treating the permission as the decision. Apple's re-auth is the admission: even Apple no longer trusts install-time consent for agents. Design your app as if the permission is the floor, not the gate.
2. Score the action, not the app. Per sensitive action: state + question + [0,1] scale, three bands — ≥0.80 auto-fire, 0.50–0.79 confirm, <0.50 escalate and log. The sweep and the tax read are different questions even when the app is identical.
3. Score the pattern, not just the payload. The "more of it" abuse shows up in timing (3 a.m.), volume (whole-directory sweeps), and destination (unnamed externals) — score those signals per action, because each individual read stays technically authorized.
4. Log the four fields. Instruction, authority, intent, outcome — appended per decision. That's Fleischer's reconstructability requirement and the record the Sept-22 bank paper and the Sept-30 FTC probe demand.
5. Narrow the lease while you build the gate. Ship context-specific, revocable scopes (the direction Apple's notice is heading) — and keep the scored layer in front of every sensitive call. A permission answers may it; the gate answers should this.

Claim receipts

FAQ

When do Apple's new Full Disk Access controls roll out? Apple didn't say — no date in the Oct 2 notice (MacRumors), and The Hacker News confirmed Oct 5 that "it's currently not known when the new controls will be rolled out." One outlet says stages over the current quarter; treat that as unconfirmed.

Does this kill backup apps that need Full Disk Access? No — Apple's notice is explicit that FDA exists "in order to allow backup apps to function properly on the Mac." The controls target how the permission is granted (more explicit user action), not legitimate holders.

Will Apple's re-authorization stop an agent from reading my files? It raises the bar for getting the permission, not for each use of it. Once an agent-class app passes the re-auth prompt, its reads are still all technically authorized — which is why per-action scoring (layer 3) remains unshipped.

Why is this on an x402/decision-gate site? Same layer, different surface. Decision-gated payments score whether the money should move (≥0.80 auto / 0.50–0.79 confirm / <0.50 escalate); this scores whether the action should fire. Consent is not judgment in either domain (the pattern).