Can your Mac's privacy settings really protect your files if you open them for an app?

1. SUMMARY — The article by Howard Oakley on eclecticlight.co demonstrates using a custom app called Insent on macOS Tahoe 26.4 to show that Privacy & Security settings can appear to deny an app access to protected folders like Documents, yet the app can still read files after the user selects a folder via an Open panel, due to macOS's "user intent" mechanism via NSOpenPanel.[1][2] This contrasts with direct access attempts that trigger consent prompts, highlighting how TCC (Transparency, Consent, and Control) distinguishes explicit consent from user-directed access.[3]

2. FACT CHECK — Claims are supported: macOS Tahoe 26.4 exists as a real release with security updates,[4] author Howard Oakley is a credible macOS expert who develops utilities and writes extensively on internals,[5] and TCC's "user intent" via NSOpenPanel grants temporary access to user-selected files/folders in protected locations (e.g., Documents) without broad folder permission showing in Privacy settings or additional prompts—this is by design since macOS Catalina, not a flaw.[6][3] Nothing misleading; the title's sensationalism ("can't trust") reflects user expectation mismatch with intended TCC behavior, confirmed in Apple's WWDC docs and security analyses.[6]

3. CREDIBILITY — 9/10 (article's technical demo aligns with verified macOS TCC mechanics; minor deduction for unlinked Insent download preventing direct repro, but consistent with author's prior tools).

4. CONFIDENCE — 10/10 (overwhelming evidence from Apple's docs, independent security research, OS release verification, and author's established expertise).

5. BIAS — CENTER. Technical analysis of macOS privacy mechanics with no political slant, focused on factual behavior from a neutral expert blogger.[7]

VERDICT — The article accurately exposes macOS TCC's designed distinction between explicit folder consent and user-intent access via Open panels, which is not a security flaw but a counterintuitive privacy feature.[3]