# What are entitlements in macOS?

> Entitlements are key value pairs signed into a Mac app that grant it permission to use a service or technology. Learn what NotchStar asks for and why.

Canonical: https://www.notchstar.com/glossary/entitlements/
Last updated: 2026-11-04

Published 2026-11-04.

Entitlements are key value pairs signed into a Mac app that grant it permission to use a service or technology. Apple's documentation lists them as available on macOS from 10.7. They are part of the signature, so an app cannot add one later without being signed again.

## Why it matters

An entitlement is the app's declared request, and macOS decides what to do with it. Under the [hardened runtime](https://www.notchstar.com/glossary/hardened-runtime/), an app cannot touch the camera or calendars unless the matching entitlement is present. Some also trigger a permission prompt the first time a feature is used.

## NotchStar's entitlements

The app's entitlements file lists three keys: calendars (`com.apple.security.personal-information.calendars`), Apple Events automation (`com.apple.security.automation.apple-events`) and the camera (`com.apple.security.device.camera`). Each maps to one tool. Calendars serve [Calendar and Reminders](https://www.notchstar.com/features/calendar-reminders/), the camera serves [Mirror](https://www.notchstar.com/features/mirror/), and Apple Events let it control Music and Spotify.

The file does not list the App Sandbox key, so NotchStar is not sandboxed. See [App Sandbox](https://www.notchstar.com/glossary/app-sandbox/).

## How to read them

For any app, you can dump the entitlements with `codesign -d --entitlements - /Applications/NotchStar.app` in Terminal.

## Related

[Is NotchStar safe](https://www.notchstar.com/guides/is-notchstar-safe/) lists the four permissions in plain terms.

## Keep reading.

- [What is the hardened runtime?](https://www.notchstar.com/glossary/hardened-runtime/): The hardened runtime is a code signing setting that limits what a Mac app can do. Learn what it blocks and how entitlements relax it.
- [What is the App Sandbox on Mac?](https://www.notchstar.com/glossary/app-sandbox/): The App Sandbox is a macOS feature that limits an app's access to system resources and user data. Learn how it differs from the hardened runtime.
- [Is NotchStar safe? Signing, permissions and what it sends](https://www.notchstar.com/guides/is-notchstar-safe/): NotchStar is signed and notarized by Apple, needs no account and sends nothing unless you opt in. See every permission it asks for and how to check it yourself.
- [Your day, at a glance, in the notch](https://www.notchstar.com/features/calendar-reminders/): See your next events and due reminders in the notch, with calendar colours and one tap completion. Uses the accounts already in your Mac.
- [A quick mirror before every call](https://www.notchstar.com/features/mirror/): Check how you look before a call with a live, mirrored camera preview in the notch. The camera runs only while the Mirror tab is open.

## More in Security and signing.

- [What is Gatekeeper on a Mac?](https://www.notchstar.com/glossary/gatekeeper/): Gatekeeper is the macOS check that decides whether downloaded software may run. Learn what it checks, why it shows warnings and how it relates to notarization.
- [What is notarization on Mac?](https://www.notchstar.com/glossary/notarization/): Notarization is Apple's automated check of Mac software before you download it. Learn what Apple says it covers and what it does not.
- [What is an Apple Developer ID?](https://www.notchstar.com/glossary/developer-id/): A Developer ID is the certificate Apple gives developers to sign Mac apps shared outside the App Store. Learn what it proves and what it does not.
- [What is a DMG file?](https://www.notchstar.com/glossary/dmg/): A DMG is a disk image, a single file that opens like a drive. Learn how apps ship in one, how to install from it and how to verify the download.
- [What is the hardened runtime?](https://www.notchstar.com/glossary/hardened-runtime/): The hardened runtime is a code signing setting that limits what a Mac app can do. Learn what it blocks and how entitlements relax it.
- [What is the App Sandbox on Mac?](https://www.notchstar.com/glossary/app-sandbox/): The App Sandbox is a macOS feature that limits an app's access to system resources and user data. Learn how it differs from the hardened runtime.