System Permissions

macOS protects sensitive data with system-level permissions (TCC). "Settings → System Permissions" manages these in one place:

• Full Disk Access: required by connectors such as Messages and Safari.
• Photos: required by the Photos connector.
• Accessibility and Automation: required by App UI and Computer Use.
• Screen Recording: required by Computer Use screenshots.
• Notifications and Location: each serves its own small feature.

Every row shows "Granted / Not granted / Unknown", and rows that are not granted have a "Grant" button on the right. What that button does falls into two categories, depending on how far macOS allows an app to go:

• Can be granted in place: Photos, Automation, Notifications. Clicking "Grant" asks the system to show its own prompt right away; approve it on the spot and the row refreshes immediately, with no restart needed.
• Must be changed in System Settings: Full Disk Access, Screen Recording, Accessibility, Location Services. For these, clicking the button only opens the matching System Settings pane — you have to tick the box yourself.

The status is detected live on the spot, not read from a stored flag, so it reflects reality better than your memory of "I definitely ticked that box" — at the cost of a few rows that cannot be fully probed:

• Full Disk Access: uses the Messages database as a probe and actually tries to read it. A permission error means "Not granted"; but if you have never used Messages on this machine and that database does not exist, the row can only show "Unknown" — this is the most common reason for "I already gave Full Disk Access, why does it still say Unknown".
• Automation: asks the system events subsystem a question; a silent success counts as granted. To make an already-granted permission truly observable, System Events may be launched in the background when needed (a windowless system agent that does not appear in the Dock); this step does not disturb you with a dialog.
• Accessibility and Screen Recording: asks the system framework for a clean boolean; without a grant, Accessibility can only tell "not granted", not whether the prompt was never shown or was refused, so it is displayed as "Unknown"; Screen Recording shows "Not granted" when the system reports an explicit denial and "Unknown" otherwise.
• Photos and Location: have native probes that read the real state. But Location also shows "Unknown" instead of "Not granted" when you have never granted it; checking whether the connector can actually pull data is more reliable than watching this row.

Status detection itself is read-only and never shows a permission prompt; prompts happen only when you click the "Grant" button on the three items above. The footer also has a "Refresh" button to re-probe everything manually.

Note: macOS caches permission decisions for already-running processes. After ticking the box in System Settings, you need to restart Klaus for the new permission to take effect — so for the items that go through the "open System Settings" path, Klaus shows a "Restart Klaus?" prompt right after you click the button, where you can restart now or later.