I presume you’re working on iOS (or watchOS or tvOS) here; if you’re developing for the Mac, things are more complex.You can think of the keychain as a database table, where rows in the table are keychain items and columns are various keychain attributes. One of those attributes is kSecAttrAccessGroup, the access group of the item. Here’s how things break down by API: For the query APIs (like SecItemCopyMatching), if you don’t supply kSecAttrAccessGroup in the query then it does a wildcard search, returning all items you have access to, that is, whose access group is contained in your app’s effective keychain access group list.OTOH, when your query contains a value for kSecAttrAccessGroup then: that value must be listed in your app’s effective keychain access group listitems are returned if their access group matches that valueWhen you create an item (SecItemAdd), if you don’t supply a value for kSecAttrAccessGroup then its access group is set to the default keychain access group.OTOH, if you do supply a valu