Why you can’t trust Privacy & Security

macOS Privacy & Security settings can be misleading: even when an app is shown as blocked from accessing protected folders like Documents in Files & Folders, it may still retain full access. This happens because user-initiated access via an Open and Save Panel bypasses TCC (Transparency, Consent, and Control) enforcement by removing the sandbox constraint for that folder — without updating the Privacy & Security UI. The only reliable way to revoke this access is running a tccutil reset command in Terminal and restarting the Mac. A demo app called Insent is provided to reproduce the behavior step by step.