Grant the Mac Permissions Your Connector Needs

Signing an Apple Account into the connected Mac is a necessary first step — but macOS keeps a second, independent layer of access control. Transparency, Consent, and Control (TCC) tracks which processes may access sensitive data categories: messages, contacts, calendars, and more. Even with a fully authenticated account, the connector cannot read message history or send messages until you grant the right TCC permissions in System Settings → Privacy & Security.

Connection setup can also require Accessibility to review the account shown on the Mac. Accessibility, Full Disk Access, and Automation each cover a distinct part of the connection lifecycle — setup, reading, and sending — and are granted independently.

A macOS TCC grant and a Figment app-level scope are separate approvals. TCC decides whether a process on this Mac may access a data category; the Figment scope, issued through the connection flow, governs which operations a developer app is authorized to perform. OS permissions support connection setup and data access; scopes control which conversations and actions the developer app can reach. OS approval alone does not extend your grant to every Figment app or every conversation.

Permission matrix

Which permissions your integration needs depends on what it does.

Accessibility supports connection setup. The setup process may need to review the account shown on the Mac; Accessibility covers this. It is not associated with a Figment messages scope — it supports establishing the connection rather than granting the developer app access to conversation data.

Full Disk Access covers the Messages database — history, search, and receipt checks. Apple describes this category as covering "data from other apps (for example, Mail, Messages, Safari, and Home)." Because it is administrator-gated, macOS will not prompt for it at runtime; you must add the connector process manually using the steps below. This OS-level grant does not alter which conversations the developer app's send scope covers.

Automation is per target app. This permission controls whether the connector can instruct Messages to send on the account's behalf; it does not grant access to any other application. Automation covers sending; Full Disk Access covers receipt checks. If your integration sends messages, both apply.

Send access is scoped to selected conversations. The messages:send grant covers specific existing conversations authorized during the Figment connection flow — not every chat on the account.

Other TCC categories — reference

Contacts, Calendars, and Reminders each have their own TCC categories — Privacy & Security → Contacts, Calendars, and Reminders respectively — and can be granted through the system dialog without administrator access. For customers, Contacts, Calendars, and Reminders are available in the synthetic sandbox only; live customer native access to those services is unavailable. These categories are separate from the iMessage connector permissions above and from Apple's account authorization for third-party apps, documented in Apple's account authorization guide.

How to grant each permission

Accessibility and Full Disk Access (administrator required):

The steps are identical for each — only the settings panel differs.

1. Open Apple menu → System Settings → Privacy & Security, then choose Accessibility (for connection setup and account review) or Full Disk Access (for history, search, and receipt checks).
2. Authenticate as an administrator if macOS asks.
3. Click +, navigate to the process identified during your connection setup, and click Open.
4. Confirm the process appears in the list with its toggle on.

Automation → Messages — iMessage send:

1. Open Apple menu → System Settings → Privacy & Security → Automation.
2. Find the row for the process identified during your connection setup, and expand it.
3. Enable the toggle for Messages.

If the row is not yet present, verify your connection setup is complete first. Check your account screen for guidance, then return here once setup is complete.

SMS, MMS, and RCS messages

When Messages in iCloud is enabled on your iPhone, SMS, MMS, and RCS messages are included in the same sync as iMessages — Apple notes that Text Message Forwarding is "built into Messages in iCloud" and does not need to be set up separately. Your iPhone must be powered on, online, and signed into the same Apple Account.

If Messages in iCloud is not enabled, Apple provides a manual alternative. Open Settings → Apps → Messages → Text Message Forwarding (older iOS: Settings → Messages → Text Message Forwarding), find your Mac in the list, and enable it. Your iPhone must be on and connected to Wi-Fi or cellular. Apple's forwarding guide covers both methods in detail.

This is an iPhone configuration, not a TCC permission on the Mac.

What the connector reports when a permission is missing

Connection status is tracked per service. Missing setup or read permissions — Accessibility or Full Disk Access — can cause the affected service to report needs_approval, even if other services are ready and the Apple Account is fully authenticated. A ready status does not prove that Automation for Messages is in place or that message delivery will succeed; readiness does not test the Automation permission. After granting a missing permission, refresh your account screen to see the updated status.

If a service that was previously ready returns to needs_approval, open System Settings and verify the relevant toggle is still on. Full Disk Access may need to be re-added if the connector process was replaced rather than updated through its standard path.

Sandbox access is free; the developer pays $29 USD/month per active live connection and access starts after setup. Register your app at the developer portal to get started.