> ## Documentation Index
> Fetch the complete documentation index at: https://docs.parable.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Pulse on managed Macs

> The device management profile that sets Parable Pulse's two macOS permissions, what it covers, and what each person still turns on.

# Pulse on managed Macs

Parable Pulse needs two macOS privacy permissions: Accessibility and Screen
Recording. A company's device management (MDM) tool can install a privacy
preferences profile that sets them on each Mac. macOS lets a profile turn on
Accessibility. It does not let a profile turn on Screen Recording, so each
person still turns that on.

## What the profile sets

| Permission | Profile value | Result on the Mac | What the person does |
| - | - | - | - |
| Accessibility | `Allow` | macOS turns the permission on for Parable Pulse. | Nothing. On macOS 27 and later, see [macOS 27](#macos-27). |
| Screen Recording | `AllowStandardUserToSetSystemService` | A person without administrator rights can turn the permission on. | Turns on Parable Pulse in **System Settings > Privacy & Security > Screen & System Audio Recording**. |

Apple's payload schema says that a profile can deny screen capture but cannot
grant it. The schema allows `AllowStandardUserToSetSystemService` only for
screen capture (`ScreenCapture`) and input monitoring (`ListenEvent`).

## Until both permissions are on

Pulse collects nothing until both permissions are on. After the person logs
in, the Pulse menubar shows **Grant Accessibility access...** or **Grant Screen
Recording access...** for each permission that is off. The item opens that
pane of System Settings. Capture starts when both permissions are on.

## Requirements

* Install the profile through device management. Apple's schema accepts it
  only on the device channel, from an MDM enrollment that the user approved.
  It does not allow a manual install, so a double-click on the file does not
  apply it.
* The profile matches only a Parable Pulse build that Parable signs with its
  Developer ID, Team ID `ZP6SUBKVZY`. It names the app by its bundle
  identifier, `work.parable.pulse.agent`, and by its code requirement.
* The Pulse background service, `work.parable.pulse.daemon`, uses neither
  permission. The profile has no entry for it.

To check that the copy of Pulse on a Mac matches the profile, run this command.
It prints nothing and exits with status 0 when the build matches.

```bash theme={null}
codesign --verify -R='identifier "work.parable.pulse.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZP6SUBKVZY' "/Applications/Parable Pulse.app"
```

## macOS 27

Apple deprecates the Accessibility setting of this profile in macOS 27. The
setting still applies. The Mac also shows a notification for the app, and the
person can turn Accessibility off in System Settings. When they do, Pulse
stops collecting and the menubar asks for the permission again.

Apple names a declarative configuration as the replacement: the `Privacy` key
of `com.apple.configuration.app.settings`. It sets a default that the person
accepts or declines in a prompt. It has no Screen Recording setting. Parable
does not publish that configuration yet.

## The profile

Save this text as `parable-pulse-privacy.mobileconfig`. Upload it to your
device management tool as a custom configuration profile.

```xml parable-pulse-privacy.mobileconfig theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDescription</key>
			<string>Turns on Accessibility for Parable Pulse. Lets a standard user turn on Screen Recording for Parable Pulse.</string>
			<key>PayloadDisplayName</key>
			<string>Parable Pulse privacy permissions</string>
			<key>PayloadIdentifier</key>
			<string>work.parable.pulse.privacy.tcc</string>
			<key>PayloadType</key>
			<string>com.apple.TCC.configuration-profile-policy</string>
			<key>PayloadUUID</key>
			<string>86A55994-1F89-4D78-9B01-75FBF932DFBE</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>Services</key>
			<dict>
				<key>Accessibility</key>
				<array>
					<dict>
						<key>Authorization</key>
						<string>Allow</string>
						<key>CodeRequirement</key>
						<string>identifier "work.parable.pulse.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZP6SUBKVZY</string>
						<key>Identifier</key>
						<string>work.parable.pulse.agent</string>
						<key>IdentifierType</key>
						<string>bundleID</string>
					</dict>
				</array>
				<key>ScreenCapture</key>
				<array>
					<dict>
						<key>Authorization</key>
						<string>AllowStandardUserToSetSystemService</string>
						<key>CodeRequirement</key>
						<string>identifier "work.parable.pulse.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZP6SUBKVZY</string>
						<key>Identifier</key>
						<string>work.parable.pulse.agent</string>
						<key>IdentifierType</key>
						<string>bundleID</string>
					</dict>
				</array>
			</dict>
		</dict>
	</array>
	<key>PayloadDescription</key>
	<string>Privacy permissions for Parable Pulse, the Parable activity agent for Mac. Install it through device management.</string>
	<key>PayloadDisplayName</key>
	<string>Parable Pulse</string>
	<key>PayloadIdentifier</key>
	<string>work.parable.pulse.privacy</string>
	<key>PayloadOrganization</key>
	<string>Parable</string>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>19BF92FE-71C2-4C95-B9BE-BB369259927F</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>
```

## Sources

* Apple, [Privacy Preferences Policy Control payload schema](https://github.com/apple/device-management/blob/release/mdm/profiles/com.apple.TCC.configuration-profile-policy.yaml):
  the install channel, the `Authorization` values, the screen capture rule,
  and the macOS 27 deprecation of `Accessibility`.
* Apple Platform Deployment, [Privacy Preferences Policy Control device management payload settings](https://support.apple.com/guide/deployment/privacy-preferences-policy-control-payload-dep38df53c2a/web).
* Apple Platform Deployment, [Privacy Preferences Policy Control custom payload examples](https://support.apple.com/guide/deployment/dep9ddb7e0b5/web):
  Apple's own screen recording example uses `AllowStandardUserToSetSystemService`.
* Apple, [App settings declarative configuration schema](https://github.com/apple/device-management/blob/release/declarative/declarations/configurations/app.settings.yaml):
  the `Privacy` key that replaces the Accessibility setting in macOS 27.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.