So, going through lots of details in no particular order: The entitlement com.apple.security.files.bookmarks.app-scope is not necessary and has no effect. Looking at our code, it's not that it’s unnecessary, it's actually that User selected read/write are both accepted as well. If you wanted to create a process that created bookmarks but didn't present open/save panels (for example, as a helper process), then you could use it. But what's confusing is this other, directly-related API where a security-scoped bookmark cannot be created under any circumstances because of the URL itself, some specific way the URL was initially created, and/or manipulated? So, the way to understand this is to invert the question, to Are there URLs which you're ALWAYS allowed to access?. The answer to that is yes. You can poke around to find other examples but they include directories like /Applications/, /Library/, and even /. Two notes on that: The right to access a given directory does NOT mean you have access to all of its subdi
Topic:
App & System Services
SubTopic:
Core OS
Tags: