# Entitlements (macOS)

Canonical page: /glossary/entitlements

API keys & secrets glossary, macOS Keychain & security. Entitlements: What They Let a Mac App Do

**Short answer:** Entitlements are specific permissions a macOS app declares as part of its code signature, such as access to the Keychain, the network, or particular hardware. macOS checks these entitlements before granting the app the corresponding capability at runtime.

## Why it matters

Because entitlements are baked into the signed app rather than granted after the fact by a user toggling a setting, they are harder to tamper with, changing them would break the app's signature.

## In Claude Keychain

Claude Keychain declares the entitlements it needs to read and write Keychain items and to launch subprocesses with a chosen environment, nothing more than what those two features require.

## Common questions

**Can I see an app's entitlements myself?**

Yes, with developer tools like codesign -d --entitlements, though this is not something most users need to check.

**Do entitlements replace the permission prompts I see?**

No, some entitlements still trigger a one-time user prompt, such as the first time an app requests Keychain access.

## Related

[Code signing](/glossary/code-signing), [App Sandbox](/glossary/app-sandbox), [Keychain access group](/glossary/keychain-access-group)