Accessibility Permissions on Mac — What They Are and Why Apps Need Them

When you install a clipboard manager, window manager, or automation tool on macOS, it asks for Accessibility permissions. The system dialog is vague — “allow this app to control your computer” — and most people click through without understanding what they’re granting.

Accessibility permissions are one of the most powerful permissions on macOS. Here’s what they actually do, why certain apps need them, and how to make sure only the right apps have them.

What Accessibility access grants

The macOS Accessibility API (AXUIElement) was originally designed for assistive technologies — screen readers, switch controls, voice input. It provides deep access to every app’s UI hierarchy: reading window titles, button labels, text field contents, and navigating the entire interface programmatically.

But it also grants two capabilities that non-assistive apps rely on:

These capabilities are bundled together. You can’t grant keystroke simulation without also granting UI inspection. It’s all or nothing — which is why macOS treats it as a high-trust permission.

Why clipboard managers need it

A clipboard manager’s core workflow has two steps: (1) write the selected item to the pasteboard, and (2) simulate ⌘V so the frontmost app pastes it. Step 1 requires no special permissions — any app can write to NSPasteboard.general. Step 2 requires Accessibility access.

The keystroke simulation uses the CGEvent API:

let source = CGEventSource(stateID: .hidSystemState)
let keyDown = CGEvent(keyboardEventSource: source, virtualKey: 0x09, keyDown: true) // V key
keyDown?.flags = .maskCommand
keyDown?.post(tap: .cghidEventTap)

Without Accessibility permissions, CGEvent.post() silently fails. No error, no exception — the event just doesn’t get delivered. The clipboard manager writes to the pasteboard successfully, but nothing gets pasted.

Security implications

Accessibility access is a significant grant of trust. An app with this permission can:

• Log every keystroke (keylogger capability)
• Read text from any app’s text fields
• Click buttons and interact with UI elements in any app
• Launch and control other applications

This is why macOS requires manual approval in System Settings — no app can grant itself Accessibility access programmatically. The user must physically navigate to the Privacy settings, unlock the pane with their password or Touch ID, and toggle the app on.

Apple has progressively tightened Accessibility permissions over macOS releases. Apps are now identified by their code signature — moving or re-downloading the app may require re-granting access. System updates sometimes reset permissions entirely.

Auditing which apps have access

You can see every app with Accessibility permissions in one place:

1. Open System Settings
2. Go to Privacy & Security → Accessibility
3. Review the list of apps and their toggle states

On the command line, you can query the TCC (Transparency, Consent, and Control) database:

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
  "SELECT client FROM access WHERE service='kTCCServiceAccessibility'"

This shows the bundle identifiers of all apps that have been granted (or denied) Accessibility access. The system-level TCC database at /Library/Application Support/com.apple.TCC/TCC.db contains permissions granted via MDM or system-level profiles.

Granting and revoking permissions

To grant Accessibility access to a new app:

1. The app will typically prompt you or open System Settings automatically
2. Navigate to System Settings → Privacy & Security → Accessibility
3. Click the + button or toggle the app on
4. Authenticate with your password or Touch ID

To revoke access, toggle the app off in the same list. The change takes effect immediately — no restart required. The app will lose the ability to simulate keystrokes and monitor events as soon as the toggle is off.

If an app’s Accessibility access isn’t working after granting it, try removing and re-adding the app. macOS sometimes caches stale permissions, especially after app updates that change the code signature.