Pulse on managed Macs

Parable Pulse needs two macOS privacy permissions: Accessibility and Screen Recording. A company’s device management (MDM) tool can install a privacy preferences profile that sets them on each Mac. macOS lets a profile turn on Accessibility. It does not let a profile turn on Screen Recording, so each person still turns that on.

What the profile sets

Permission	Profile value	Result on the Mac	What the person does
Accessibility	`Allow`	macOS turns the permission on for Parable Pulse.	Nothing. On macOS 27 and later, see macOS 27.
Screen Recording	`AllowStandardUserToSetSystemService`	A person without administrator rights can turn the permission on.	Turns on Parable Pulse in System Settings > Privacy & Security > Screen & System Audio Recording.

Apple’s payload schema says that a profile can deny screen capture but cannot grant it. The schema allows AllowStandardUserToSetSystemService only for screen capture (ScreenCapture) and input monitoring (ListenEvent).

Until both permissions are on

Pulse collects nothing until both permissions are on. After the person logs in, the Pulse menubar shows Grant Accessibility access… or Grant Screen Recording access… for each permission that is off. The item opens that pane of System Settings. Capture starts when both permissions are on.

Requirements

Install the profile through device management. Apple’s schema accepts it only on the device channel, from an MDM enrollment that the user approved. It does not allow a manual install, so a double-click on the file does not apply it.
The profile matches only a Parable Pulse build that Parable signs with its Developer ID, Team ID ZP6SUBKVZY. It names the app by its bundle identifier, work.parable.pulse.agent, and by its code requirement.
The Pulse background service, work.parable.pulse.daemon, uses neither permission. The profile has no entry for it.

To check that the copy of Pulse on a Mac matches the profile, run this command. It prints nothing and exits with status 0 when the build matches.

codesign --verify -R='identifier "work.parable.pulse.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZP6SUBKVZY' "/Applications/Parable Pulse.app"

macOS 27

Apple deprecates the Accessibility setting of this profile in macOS 27. The setting still applies. The Mac also shows a notification for the app, and the person can turn Accessibility off in System Settings. When they do, Pulse stops collecting and the menubar asks for the permission again. Apple names a declarative configuration as the replacement: the Privacy key of com.apple.configuration.app.settings. It sets a default that the person accepts or declines in a prompt. It has no Screen Recording setting. Parable does not publish that configuration yet.

The profile

Save this text as parable-pulse-privacy.mobileconfig. Upload it to your device management tool as a custom configuration profile.

parable-pulse-privacy.mobileconfig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDescription</key>
			<string>Turns on Accessibility for Parable Pulse. Lets a standard user turn on Screen Recording for Parable Pulse.</string>
			<key>PayloadDisplayName</key>
			<string>Parable Pulse privacy permissions</string>
			<key>PayloadIdentifier</key>
			<string>work.parable.pulse.privacy.tcc</string>
			<key>PayloadType</key>
			<string>com.apple.TCC.configuration-profile-policy</string>
			<key>PayloadUUID</key>
			<string>86A55994-1F89-4D78-9B01-75FBF932DFBE</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>Services</key>
			<dict>
				<key>Accessibility</key>
				<array>
					<dict>
						<key>Authorization</key>
						<string>Allow</string>
						<key>CodeRequirement</key>
						<string>identifier "work.parable.pulse.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZP6SUBKVZY</string>
						<key>Identifier</key>
						<string>work.parable.pulse.agent</string>
						<key>IdentifierType</key>
						<string>bundleID</string>
					</dict>
				</array>
				<key>ScreenCapture</key>
				<array>
					<dict>
						<key>Authorization</key>
						<string>AllowStandardUserToSetSystemService</string>
						<key>CodeRequirement</key>
						<string>identifier "work.parable.pulse.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZP6SUBKVZY</string>
						<key>Identifier</key>
						<string>work.parable.pulse.agent</string>
						<key>IdentifierType</key>
						<string>bundleID</string>
					</dict>
				</array>
			</dict>
		</dict>
	</array>
	<key>PayloadDescription</key>
	<string>Privacy permissions for Parable Pulse, the Parable activity agent for Mac. Install it through device management.</string>
	<key>PayloadDisplayName</key>
	<string>Parable Pulse</string>
	<key>PayloadIdentifier</key>
	<string>work.parable.pulse.privacy</string>
	<key>PayloadOrganization</key>
	<string>Parable</string>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>19BF92FE-71C2-4C95-B9BE-BB369259927F</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

Sources

Apple, Privacy Preferences Policy Control payload schema: the install channel, the Authorization values, the screen capture rule, and the macOS 27 deprecation of Accessibility.
Apple Platform Deployment, Privacy Preferences Policy Control device management payload settings.
Apple Platform Deployment, Privacy Preferences Policy Control custom payload examples: Apple’s own screen recording example uses AllowStandardUserToSetSystemService.
Apple, App settings declarative configuration schema: the Privacy key that replaces the Accessibility setting in macOS 27.

​Pulse on managed Macs

​What the profile sets

​Until both permissions are on

​Requirements

​macOS 27

​The profile

​Sources