ApexDock isn't sandboxed, because it manages other apps' windows, drives the macOS Dock, and offers a local scripting socket for power users. Every individual capability still goes through macOS's standard permission prompts. Each one is opt-in and revocable from System Settings.
The full list lives at Settings → Permissions, with one-click grant buttons for each.
Bar essentials
| Permission | Why ApexDock needs it |
|---|---|
| Accessibility | Resizing windows that intrude into the bar's strip; reading window lists for window peek; the ⌘ Space command palette hotkey. |
| Automation (System Events) | Opening Notification Center via the bell tray icon. |
| Location | Reading the current Wi-Fi network name. macOS gates SSID lookup behind Location. ApexDock never stores or transmits location. |
These three are the minimum the default bar needs. Decline them and: window minder won't fire, the bell button is a no-op, and Wi-Fi shows "Wi-Fi" without the SSID.
AI Assistant
Required only if you turn on the Assistant.
| Permission | Why ApexDock needs it |
|---|---|
| Microphone | Captures your voice while you hold the assistant push-to-talk hotkey. |
| Screen Recording | Captures a screenshot of the active display so the model has visual context. Also used by Window Peek thumbnails. |
| Speech Recognition | The on-device transcription fallback, used when no cloud STT key is configured. |
Decline any of these and the assistant disables that capability gracefully — recording without microphone access just produces silence; without Screen Recording the model gets only your transcribed prompt.
Calendar
| Permission | Why ApexDock needs it |
|---|---|
| Calendar | Reads your events to render the next-meeting badge and the today's-schedule list in the calendar popover. |
Calendar data never leaves your Mac. ApexDock reads through Apple's standard read-only calendar interface and only ever looks at the next 30 days.
Granting in advance vs. on first use
Each permission prompts on first use of the related feature. If you'd rather grant them all up-front:
- Open Settings → Permissions.
- Click Grant next to each row.
- macOS opens System Settings to the right pane — toggle on, return to ApexDock.
ApexDock re-checks the status when the Settings window foregrounds, so the row updates without a restart.
Revoking
System Settings → Privacy & Security has the canonical toggles. Removing ApexDock from any row immediately revokes that capability. The next launch picks up the change and the dependent feature falls back to a degraded mode.
What ApexDock will never ask for
- Full Disk Access
- Network Extensions / VPN profiles
- Admin privileges (the CLI symlink is the only
sudostep, and it's optional) - Any cloud account beyond keys you paste yourself for the assistant
If you see a permission prompt that doesn't match this list, file a bug at the GitHub issue tracker.