<!--
{
  "documentType" : "article",
  "framework" : "BundleResources",
  "identifier" : "/documentation/BundleResources/security-entitlements",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Security entitlements"
}
-->

# Security entitlements

Key-value pairs that grant an executable access to secure resources, or enable hardening checks.

## Topics

### Automation

[`com.apple.security.automation.apple-events`](/documentation/BundleResources/Entitlements/com.apple.security.automation.apple-events)

A Boolean value that indicates whether the app may prompt the user for permission to send Apple events to other apps.

### Networking

[`com.apple.security.network.server`](/documentation/BundleResources/Entitlements/com.apple.security.network.server)

A Boolean value indicating whether your app may listen for incoming network connections.

[`com.apple.security.network.client`](/documentation/BundleResources/Entitlements/com.apple.security.network.client)

A Boolean value indicating whether your app may open outgoing network connections.

[`com.apple.developer.devicecheck.appattest-environment`](/documentation/BundleResources/Entitlements/com.apple.developer.devicecheck.appattest-environment)

The environment for an app that uses the App Attest service to validate itself.

### Device access

[`com.apple.security.device.audio-input`](/documentation/BundleResources/Entitlements/com.apple.security.device.audio-input)

A Boolean value that indicates whether the app may record audio using the built-in microphone and access audio input using Core Audio.

[`com.apple.security.device.camera`](/documentation/BundleResources/Entitlements/com.apple.security.device.camera)

A Boolean value that indicates whether the app may interact with the built-in and external cameras, and capture movies and still images.

[`com.apple.security.device.microphone`](/documentation/BundleResources/Entitlements/com.apple.security.device.microphone)

A Boolean value that indicates whether the app may use the microphone.

[`com.apple.security.device.usb`](/documentation/BundleResources/Entitlements/com.apple.security.device.usb)

A Boolean value indicating whether your app may interact with USB devices.

[`com.apple.security.print`](/documentation/BundleResources/Entitlements/com.apple.security.print)

A Boolean value indicating whether your app may print a document.

[`com.apple.security.device.bluetooth`](/documentation/BundleResources/Entitlements/com.apple.security.device.bluetooth)

A Boolean value indicating whether your app may interact with Bluetooth devices.

[`com.apple.security.smartcard`](/documentation/BundleResources/Entitlements/com.apple.security.smartcard)

A Boolean that indicates whether your app has access to smart card slots and smart cards.

### Personal information

[`com.apple.security.personal-information.addressbook`](/documentation/BundleResources/Entitlements/com.apple.security.personal-information.addressbook)

A Boolean value that indicates whether the app may have read-write access to contacts in the user’s address book.

[`com.apple.security.personal-information.location`](/documentation/BundleResources/Entitlements/com.apple.security.personal-information.location)

A Boolean value that indicates whether the app may access location information from Location Services.

[`com.apple.security.personal-information.calendars`](/documentation/BundleResources/Entitlements/com.apple.security.personal-information.calendars)

A Boolean value that indicates whether the app may have read-write access to the user’s calendar.

[`com.apple.security.personal-information.photos-library`](/documentation/BundleResources/Entitlements/com.apple.security.personal-information.photos-library)

A Boolean value that indicates whether the app has read-write access to the user’s Photos library.

### Files and media

[`com.apple.security.app-sandbox`](/documentation/BundleResources/Entitlements/com.apple.security.app-sandbox)

A Boolean value that indicates whether the app may use access control technology to contain damage to the system and user data if an app is compromised.

[`com.apple.security.files.user-selected.read-only`](/documentation/BundleResources/Entitlements/com.apple.security.files.user-selected.read-only)

A Boolean value that indicates whether the app may have read-only access to files the user has selected using an Open or Save dialog.

[`com.apple.security.files.user-selected.read-write`](/documentation/BundleResources/Entitlements/com.apple.security.files.user-selected.read-write)

A Boolean value that indicates whether the app may have read-write access to files the user has selected using an Open or Save dialog.

[`com.apple.security.files.downloads.read-only`](/documentation/BundleResources/Entitlements/com.apple.security.files.downloads.read-only)

A Boolean value that indicates whether the app may have read-only access to the Downloads folder.

[`com.apple.security.files.downloads.read-write`](/documentation/BundleResources/Entitlements/com.apple.security.files.downloads.read-write)

A Boolean value that indicates whether the app may have read-write access to the Downloads folder.

[`com.apple.developer.security.privileged-file-operations`](/documentation/BundleResources/Entitlements/com.apple.developer.security.privileged-file-operations)

An entitlement that permits apps to create symbolic links, replace files, and set file attributes.

[`com.apple.security.assets.pictures.read-only`](/documentation/BundleResources/Entitlements/com.apple.security.assets.pictures.read-only)

A Boolean value that indicates whether the app may have read-only access to the Pictures folder.

[`com.apple.security.assets.pictures.read-write`](/documentation/BundleResources/Entitlements/com.apple.security.assets.pictures.read-write)

A Boolean value that indicates whether the app may have read-write access to the Pictures folder.

[`com.apple.security.assets.music.read-only`](/documentation/BundleResources/Entitlements/com.apple.security.assets.music.read-only)

A Boolean value that indicates whether the app may have read-only access to the Music folder.

[`com.apple.security.assets.music.read-write`](/documentation/BundleResources/Entitlements/com.apple.security.assets.music.read-write)

A Boolean value that indicates whether the app may have read-write access to the Music folder.

[`com.apple.security.assets.movies.read-only`](/documentation/BundleResources/Entitlements/com.apple.security.assets.movies.read-only)

A Boolean value that indicates whether the app may have read-only access to the Movies folder.

[`com.apple.security.assets.movies.read-write`](/documentation/BundleResources/Entitlements/com.apple.security.assets.movies.read-write)

A Boolean value that indicates whether the app may have read-write access to the Movies folder.

[`com.apple.security.files.all`](/documentation/BundleResources/Entitlements/com.apple.security.files.all)

A Boolean value that indicates whether the app may have access to all files.

[`com.apple.developer.default-data-protection`](/documentation/BundleResources/Entitlements/com.apple.developer.default-data-protection)

The level of data protection for sensitive user data when an app accesses it on a device.

### Hardened runtime

[`com.apple.security.cs.allow-jit`](/documentation/BundleResources/Entitlements/com.apple.security.cs.allow-jit)

A Boolean value that indicates whether the app may create writable and executable memory using the `MAP_JIT` flag.

[`com.apple.security.cs.allow-unsigned-executable-memory`](/documentation/BundleResources/Entitlements/com.apple.security.cs.allow-unsigned-executable-memory)

A Boolean value that indicates whether the app may create writable and executable memory without the restrictions imposed by using the `MAP_JIT` flag.

[`com.apple.security.cs.allow-dyld-environment-variables`](/documentation/BundleResources/Entitlements/com.apple.security.cs.allow-dyld-environment-variables)

A Boolean value that indicates whether the app may be affected by dynamic linker environment variables, which you can use to inject code into your app’s process.

[`com.apple.security.cs.disable-library-validation`](/documentation/BundleResources/Entitlements/com.apple.security.cs.disable-library-validation)

A Boolean value that indicates whether the app loads arbitrary plug-ins or frameworks, without requiring code signing.

[`com.apple.security.cs.disable-executable-page-protection`](/documentation/BundleResources/Entitlements/com.apple.security.cs.disable-executable-page-protection)

A Boolean value that indicates whether to disable all code signing protections while launching an app, and during its execution.

[`com.apple.security.cs.debugger`](/documentation/BundleResources/Entitlements/com.apple.security.cs.debugger)

A Boolean value that indicates whether the app is a debugger and may attach to other processes or get task ports.

### Hardened process

[`com.apple.security.hardened-process`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process)

A Boolean value that indicates whether the executable opts in to additional security checks.

[`com.apple.security.hardened-process.enhanced-security-version`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.enhanced-security-version)

The entitlement required for an executable to opt in to enhanced security protections.

[`com.apple.security.hardened-process.enhanced-security-version-string`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.enhanced-security-version-string)

The entitlement required for an executable to opt in to enhanced security protections.

[`com.apple.security.hardened-process.hardened-heap`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.hardened-heap)

A Boolean value that indicates whether your app or extension opts in to additional hardening for heap allocations.

[`com.apple.security.hardened-process.platform-restrictions`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.platform-restrictions)

An integer value that indicates the level of additional runtime security protections your app or extension opts in to.

[`com.apple.security.hardened-process.platform-restrictions-string`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.platform-restrictions-string)

A string value that indicates the level of additional runtime security protections your app or extension opts in to.

[`com.apple.security.hardened-process.dyld-ro`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.dyld-ro)

An entitlement that marks memory used for internal platform state as read-only.

[`com.apple.security.hardened-process.no-guard-objects`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.no-guard-objects)

A Boolean value that turns off guard objects for the process.

### Hardware memory tagging

[`com.apple.security.hardened-process.checked-allocations`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.checked-allocations)

A Boolean value that enables tagging of pointers and memory allocations.

[`com.apple.security.hardened-process.checked-allocations.soft-mode`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.checked-allocations.soft-mode)

A Boolean value that indicates
whether to log memory-tagging faults as a simulated crash,
instead of terminating the process.

[`com.apple.security.hardened-process.checked-allocations.enable-pure-data`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.checked-allocations.enable-pure-data)

A Boolean value that indicates whether to tag memory that contains only data.

[`com.apple.security.hardened-process.checked-allocations.no-tagged-receive`](/documentation/BundleResources/Entitlements/com.apple.security.hardened-process.checked-allocations.no-tagged-receive)

A Boolean value that indicates whether to
prevent receiving tagged memory from other processes.

### Application groups

[`com.apple.security.application-groups`](/documentation/BundleResources/Entitlements/com.apple.security.application-groups)

A list of identifiers specifying the groups your app belongs to.

[`keychain-access-groups`](/documentation/BundleResources/Entitlements/keychain-access-groups)

The identifiers for the keychain groups that the app may share items with.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)