FeaturesCompareGuidesPricingFAQ Buy $4 Download the free trial

What are entitlements in macOS?

Security and signing Published

All of glossary Try NotchStar in the browser Buy for $4

Entitlements are key value pairs signed into a Mac app that grant it permission to use a service or technology. Apple’s documentation lists them as available on macOS from 10.7. They are part of the signature, so an app cannot add one later without being signed again.

Why it matters

An entitlement is the app’s declared request, and macOS decides what to do with it. Under the hardened runtime, an app cannot touch the camera or calendars unless the matching entitlement is present. Some also trigger a permission prompt the first time a feature is used.

NotchStar’s entitlements

The app’s entitlements file lists three keys: calendars (com.apple.security.personal-information.calendars), Apple Events automation (com.apple.security.automation.apple-events) and the camera (com.apple.security.device.camera). Each maps to one tool. Calendars serve Calendar and Reminders, the camera serves Mirror, and Apple Events let it control Music and Spotify.

The file does not list the App Sandbox key, so NotchStar is not sandboxed. See App Sandbox.

How to read them

For any app, you can dump the entitlements with codesign -d --entitlements - /Applications/NotchStar.app in Terminal.

Is NotchStar safe lists the four permissions in plain terms.

Keep reading.

What is the hardened runtime?
The hardened runtime is a code signing setting that limits what a Mac app can do. Learn what it blocks and how entitlements relax it.
What is the App Sandbox on Mac?
The App Sandbox is a macOS feature that limits an app's access to system resources and user data. Learn how it differs from the hardened runtime.
Is NotchStar safe? Signing, permissions and what it sends
NotchStar is signed and notarized by Apple, needs no account and sends nothing unless you opt in. See every permission it asks for and how to check it yourself.
Your day, at a glance, in the notch
See your next events and due reminders in the notch, with calendar colours and one tap completion. Uses the accounts already in your Mac.
A quick mirror before every call
Check how you look before a call with a live, mirrored camera preview in the notch. The camera runs only while the Mirror tab is open.

More in Security and signing.

What is Gatekeeper on a Mac?
Gatekeeper is the macOS check that decides whether downloaded software may run. Learn what it checks, why it shows warnings and how it relates to notarization.
What is notarization on Mac?
Notarization is Apple's automated check of Mac software before you download it. Learn what Apple says it covers and what it does not.
What is an Apple Developer ID?
A Developer ID is the certificate Apple gives developers to sign Mac apps shared outside the App Store. Learn what it proves and what it does not.
What is a DMG file?
A DMG is a disk image, a single file that opens like a drive. Learn how apps ship in one, how to install from it and how to verify the download.
What is the hardened runtime?
The hardened runtime is a code signing setting that limits what a Mac app can do. Learn what it blocks and how entitlements relax it.
What is the App Sandbox on Mac?
The App Sandbox is a macOS feature that limits an app's access to system resources and user data. Learn how it differs from the hardened runtime.
NotchStar app icon

Put your notch to work.

Buy it once for $4, activate it in a minute, and keep it. Not sure yet? Try every tool in the browser on the home page, or install the 7 day trial.

Buy NotchStar for $4 Try it in the browser