macOS TCC permissions for unattended AI agents: stop losing nights to hidden prompts

Jessy Brenenstahl — Fri, 16 Oct 2026 11:45:47 +0000

If you run AI agents unattended on a Mac (Claude Code in iTerm, a launchd job driving osascript, Hammerspoon clicking buttons), you've probably woken up to find nothing happened overnight. The cause is usually one dialog sitting on an unwatched screen: "Terminal" would like to control "System Events".

That's macOS TCC (Transparency, Consent and Control). Here's how to set it up once so it stops eating your nights.

The key idea: permissions belong to the host app

TCC grants go to the app that launches the process, not to your script. If claude runs inside iTerm, iTerm needs the grant. If a launchd job runs /bin/bash script.sh, the grant goes to whatever binary macOS names in the prompt.

So the first rule is: pick one terminal app as your agent host and grant everything there. Spreading agents across Terminal, iTerm, Warp and VS Code means four sets of grants that drift out of sync.

What each agent task needs

Agent task	Privacy & Security pane
Click/type into other apps (AX, Hammerspoon)	Accessibility
`osascript` controlling another app	Automation (once per target app)
Screenshots / screen reading	Screen & System Audio Recording (relaunch after granting)
~/Documents, Desktop, Downloads	Files and Folders
Mail, Messages, Safari data	Full Disk Access (only if really needed)
Global hotkeys	Input Monitoring

Trigger the prompts while you're watching

Automation prompts only appear the first time an app tries to control a target. Run each one deliberately during setup, not at 3am:

osascript -e 'tell application "System Events" to get name of first process'
osascript -e 'tell application "Finder" to get name of startup disk'

Click Allow on each, then you're done for that host/target pair.

A read-only health check before bed

Don't edit the TCC database (and don't disable SIP). Just check that things still work:

osascript -e 'tell application "System Events" to get name of first process' >/dev/null 2>&1 \
  && echo "automation OK" || echo "automation BROKEN"
screencapture -x /tmp/tcc-check.png && echo "screen OK"

If either fails, fix it now instead of finding out in the morning.

After macOS updates

Updates and app re-signing can silently invalidate grants: the toggle still looks on, but it no longer applies. The fix that works most often is to remove the app from the list with the minus button, add it back, and relaunch it.

The free first-time setup checklist is on GitHub: agent-ops-samples.
The full macOS TCC Agent Fleet Runbook ($12) adds the complete permission map, symptom-to-fix recovery steps and a fleet log for tracking grants across machines.

Your AI coding agents are reading conflicting instructions

Jessy Brenenstahl — Fri, 16 Oct 2026 11:45:00 +0000

Run Claude Code, Codex and Cursor on the same repo for a week and you'll end up with a CLAUDE.md, an AGENTS.md, a .cursor/rules folder and a README that each say something slightly different. One says "use pnpm", another says "npm is fine". One says "never touch migrations", another has a migration workflow.

Agents don't flag these conflicts. They just follow whichever rule they read last, or whichever one is closest to the task. So you get behavior that changes depending on which tool you opened that morning.

Step 1: find every instruction file

find . -maxdepth 4 \( -name 'CLAUDE.md' -o -name 'AGENTS.md' -o -name '.cursorrules' \
  -o -path '*/.cursor/rules/*' -o -name 'GEMINI.md' -o -name 'RULES.md' \) -not -path '*/node_modules/*'
ls ~/.claude/CLAUDE.md ~/.codex/AGENTS.md 2>/dev/null   # global files follow you into every repo

Global home-dir files are the sneaky ones. They're applied to every project and quietly override project facts.

Step 2: list the contradictions

Go through the files topic by topic: package manager, test command, branch/commit rules, what counts as "done", forbidden directories. Write each conflict down as "File A says X, file B says Y".

Step 3: declare a precedence order, and tell the agents

When two rules disagree, the higher one wins:

The live human message in the current session
Safety rules (no force-push, no secrets, no deleting outside the repo). Never overridden by anything lower.
The nearest scoped file (sub/dir/RULES.md beats root for files under sub/dir)
The canonical root RULES.md
Agent-specific pointer files (CLAUDE.md, AGENTS.md, .cursor/rules), for tool quirks only
Global home-dir files, for personal defaults only
README / docs prose: background, not instructions

Paste this at the top of your canonical file:

Precedence: the user's current message > Safety section below > the nearest RULES.md in the directory tree > this file > agent-specific files > global defaults. If two rules conflict and this order doesn't settle it, stop and ask. Don't pick one.

That last sentence matters most. "Stop and ask" turns a silent wrong guess into a visible question.

Step 4: one source, thin pointers

Put the real rules in one RULES.md. Make CLAUDE.md and AGENTS.md a few lines each: "Read RULES.md first. Tool-specific notes: ..." Now there's only one place to edit, and the agents can't drift apart.

Step 5: log decisions

Keep a short conflict log ("2026-10-12: pnpm wins, npm lines removed from AGENTS.md"). Without it, an agent will happily reintroduce the rule you deleted last week because it found it in an old commit message.

The free audit checklist is on GitHub: agent-ops-samples.
If you want the full set (precedence model, single-source templates for RULES.md / CLAUDE.md / AGENTS.md / Cursor, conflict log), it's the Agent Instructions Conflict Kit ($9).

DEV Community: Jessy Brenenstahl