# Access Control Lists Control which apps have access to keychain items in macOS. ## Discussion In macOS, for items not stored on the iCloud keychain, each protected keychain item—like a password or private key—has an associated access instance that contains an access control list (ACL). The entries in this list in turn each contain an array of operations and an array of apps trusted to carry out those operations with the item. The collection of ACL entries govern the accessibility of the corresponding keychain item.  When an app attempts to access a keychain item for a particular purpose—like using a private key to sign a document—the system looks for an entry in the item’s ACL containing the operation. If there’s no entry that lists the operation, then the system denies access and it’s up to the calling app to try something else or to notify the user. If there is an entry that lists the operation, the system checks whether the calling app is among the entry’s trusted apps. If so, the system grants access. Otherwise, the system prompts the user for confirmation. The user may choose to Deny, Allow, or Always Allow the access. In the latter case, the system adds the app to the list of trusted apps for that entry, enabling the app to gain access in the future without prompting the user again. > Important: > ACLs are not available in iOS or in macOS apps that use the iCloud keychain. For keychain item sharing in those environments, use access groups instead. See . ## Topics ### Access Creation [`SecAccessCreate(_:_:_:)`](/documentation/Security/SecAccessCreate(_:_:_:)) Creates a new access instance associated with a given protected keychain item. [`SecAccessCreateWithOwnerAndACL(_:_:_:_:_:)`](/documentation/Security/SecAccessCreateWithOwnerAndACL(_:_:_:_:_:)) Creates a new access instance using the owner and ACL entries you provide. [`SecAccessOwnerType`](/documentation/Security/SecAccessOwnerType) A type for flags that enable you to configure ACL ownership. [SecAccessOwnerType Values](/documentation/Security/SecAccessOwnerType-values) Flags that enable you to configure ACL ownership. [`SecAccess`](/documentation/Security/SecAccess) An opaque type that identifies a keychain item’s access information. [`SecAccessGetTypeID()`](/documentation/Security/SecAccessGetTypeID()) Returns the unique identifier of the opaque type to which an access instance belongs. ### Access Query [`SecAccessCopyACLList(_:_:)`](/documentation/Security/SecAccessCopyACLList(_:_:)) Retrieves all the ACL entries of a given access instance. [`SecAccessCopyMatchingACLList(_:_:)`](/documentation/Security/SecAccessCopyMatchingACLList(_:_:)) Retrieves selected ACL entries from a given access instance. [`SecAccessCopyOwnerAndACL(_:_:_:_:_:)`](/documentation/Security/SecAccessCopyOwnerAndACL(_:_:_:_:_:)) Retrieves the owner and the ACL entries of a given access instance. ### Access Control List Entries [`SecACLCreateWithSimpleContents(_:_:_:_:_:)`](/documentation/Security/SecACLCreateWithSimpleContents(_:_:_:_:_:)) Creates a new ACL entry with the given characteristics, and adds it to an access instance. [`SecACLRemove(_:)`](/documentation/Security/SecACLRemove(_:)) Removes the specified ACL entry from the access instance that contains it. [ACL Authorization Keys](/documentation/Security/acl-authorization-keys) The operations an access control list entry applies to. [`SecKeychainPromptSelector`](/documentation/Security/SecKeychainPromptSelector) Bits that define when a keychain should require a passphrase. [`SecACL`](/documentation/Security/SecACL) An opaque type that represents information about an ACL entry. [`SecACLGetTypeID()`](/documentation/Security/SecACLGetTypeID()) Returns the unique identifier of the opaque type to which an ACL entry belongs. ### Access Control List Configuration [`SecACLCopyContents(_:_:_:_:)`](/documentation/Security/SecACLCopyContents(_:_:_:_:)) Returns the application list, description, and prompt selector for a given ACL entry. [`SecACLSetContents(_:_:_:_:)`](/documentation/Security/SecACLSetContents(_:_:_:_:)) Sets the application list, description, and prompt selector for a given ACL entry. [`SecACLCopyAuthorizations(_:)`](/documentation/Security/SecACLCopyAuthorizations(_:)) Retrieves the authorization tags of a given ACL entry. [`SecACLUpdateAuthorizations(_:_:)`](/documentation/Security/SecACLUpdateAuthorizations(_:_:)) Sets the authorization tags for a given ACL. ### Trusted Applications [`SecTrustedApplicationCreateFromPath(_:_:)`](/documentation/Security/SecTrustedApplicationCreateFromPath(_:_:)) Creates a trusted app instance based on the app at the given path in the file system. [`SecTrustedApplicationCopyData(_:_:)`](/documentation/Security/SecTrustedApplicationCopyData(_:_:)) Retrieves the data of a trusted app instance. [`SecTrustedApplicationSetData(_:_:)`](/documentation/Security/SecTrustedApplicationSetData(_:_:)) Sets the data of a given trusted app instance. [`SecTrustedApplication`](/documentation/Security/SecTrustedApplication) An opaque type that contains information about a trusted app. [`SecTrustedApplicationGetTypeID()`](/documentation/Security/SecTrustedApplicationGetTypeID()) Returns the unique identifier of the opaque type to which a trusted app instance belongs. ### Keychain Item Access [`SecKeychainItemSetAccess(_:_:)`](/documentation/Security/SecKeychainItemSetAccess(_:_:)) Sets the access of a given keychain item. [`SecKeychainItemCopyAccess(_:_:)`](/documentation/Security/SecKeychainItemCopyAccess(_:_:)) Retrieves the access of a given keychain item. ### Legacy Access Control Operations [`SecACLCreateFromSimpleContents`](/documentation/Security/SecACLCreateFromSimpleContents) Creates a new access control list entry from the application list, description, and prompt selector provided and adds it to an item’s access object. [`SecACLCopySimpleContents`](/documentation/Security/SecACLCopySimpleContents) Returns the application list, description, and CSSM prompt selector for a given access control list entry. [`SecACLSetSimpleContents`](/documentation/Security/SecACLSetSimpleContents) Sets the application list, description, and prompt selector for a given access control list entry. [`SecACLGetAuthorizations`](/documentation/Security/SecACLGetAuthorizations) Retrieves the CSSM authorization tags of a given access control list entry. [`SecACLSetAuthorizations`](/documentation/Security/SecACLSetAuthorizations) Sets the CSSM authorization tags for a given access control list entry. [`SecAccessCopySelectedACLList`](/documentation/Security/SecAccessCopySelectedACLList) Retrieves selected access control lists from a given access object. [`SecAccessCreateFromOwnerAndACL`](/documentation/Security/SecAccessCreateFromOwnerAndACL) Creates a new access object using the owner and access control list you provide. [`SecAccessGetOwnerAndACL`](/documentation/Security/SecAccessGetOwnerAndACL) Retrieves the owner and the access control list of a given access object. [`OpaqueSecAccessRef`](/documentation/Security/OpaqueSecAccessRef) --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)