Module policy 

Application policy: built-in deny list plus user and admin policy.toml.

Resolution order is built-in deny, then admin policy, then user policy. Deny wins. A user allow cannot override an admin deny or a built-in deny. Admin allow entries do not grant access. A missing user file is default = "allow" plus this built-in list. pause_on_user_input defaults to false when the key is absent, so a missing file does not install an event tap.

Structs

ConfirmDocument

JSON object written to the confirm hook’s stdin.

Denial

Why a built-in rule refused an app.

LoadedPolicy

Merged admin and user policy.

PauseOverride

Clears a test pause override when dropped.

Subject

Resolved target passed to decide.

Enums

Decision

Allow, refuse, or ask the confirm hook.

PolicyAction

How decide classifies an action.

Constants

SYNTHETIC_EVENT_USER_DATA

Marker stored in kCGEventSourceUserData (CGEventField::EventSourceUserData, value 42).

Functions

app_verdict

Allow or deny for policy check. Never returns Decision::Confirm.

confirm_program

Program from the flag, then COMPUTER_USE_CONFIRM_CMD, then user policy, then admin.

decide

Built-in deny, then admin, then user. Deny wins over allow.

deny_or_allow

Map a denial to ComputerError::PolicyDenied.

event_is_synthetic

True when a tap event was posted by this process and must not pause.

identity_denial

Refuse a resolved app. System Settings is refused only when the targeted window title or accessibility identifier mentions Privacy or Security.

is_browser

Safari, Chrome, Chromium, Edge, Brave, Arc, and Firefox.

is_paused

Whether mutating actions must return paused.

key_needs_confirm

cmd+q and alt+f4.

load_paths

Load two already chosen files. None means that file is absent.

load_policy

Load the user file at explicit (or the default path) and merge the admin file.

override_paused

Force is_paused on this thread until the guard drops.

quit_is_protected

loginwindow, WindowServer, and this process cannot be quit.

run_confirm

Spawn the hook. Exit 0 proceeds. Any other result is confirm_denied.

selector_denial

Refuse selector before it is resolved, when the selector itself is enough.

sensitive_title

Click or AXPress titles that need confirmation.

set_paused

Set or clear the pause flag and the paused file next to the audit log.

split_command

Split a command into a program and arguments. Quotes may use " or '.

url_blocked

Pattern that matches url, if any. * matches any span, including empty.

url_in_text

First http://, https://, or file:// token in text.