How to reset privacy permissions on a Mac with tccutil

tccutil is the quickest fix when a permission is stuck: an app that's switched on but still can't work, or one you answered Don't Allow to and want asked again. It only ever removes answers: it can't give an app access to anything.

What tccutil does

tccutil comes with macOS. Its manual page (man tccutil in Terminal) describes it as managing the privacy database, which stores the decisions you've made about whether apps may access personal data: the same decisions as the switches in System Settings › Privacy & Security. It has one command:

tccutil reset SERVICE [BUNDLE_ID]

reset clears every decision for that service, so apps ask again the next time they use it. Add a bundle ID and only that app's decision is cleared. tccutil can't allow or deny anything, and it can't list which apps have a permission: do those in System Settings.

Run it in Terminal, in the Utilities folder inside Applications, as yourself. Apple's examples in the manual page don't use sudo.

Reset one permission for one app

1. Find the two names

   You need the service name from the table below and the app's bundle ID (how to find it).

2. Run the reset

   Type the command and press Return. This one makes macOS ask again before Terminal, or a script you run in it, controls another app:

   tccutil reset AppleEvents com.apple.Terminal

3. Read the reply

   On success it prints Successfully reset, the service and the bundle ID. Then use the app again, or allow it again in System Settings.

When it doesn't work, the reply says why:

Find an app's bundle ID

A bundle ID is an app's unique identifier, written like a reversed web address: Safari is com.apple.Safari and Google Chrome is com.google.Chrome. System Settings doesn't show it, but Terminal will. Any of these works; put the app's name or path in place of Safari's:

osascript -e 'id of app "Safari"'

defaults read /Applications/Safari.app/Contents/Info CFBundleIdentifier

mdls -name kMDItemCFBundleIdentifier -raw /Applications/Safari.app

The first looks the app up by name and doesn't open it. The other two read it from the app's files: dragging the app from Finder into Terminal types its path for you. mdls relies on Spotlight, so it can come back empty for an app Spotlight hasn't indexed.

Service names

The names tccutil wants aren't the ones System Settings shows: Automation is AppleEvents and Screen Recording is ScreenCapture. Type them exactly as written here.

These were checked on macOS 26.2: tccutil adds the prefix kTCCService to the name you type, and each name above is one the privacy system in macOS defines. Apple's device management reference lists the same names, apart from All, with what each one covers.

Reset every permission for an app

Use All with a bundle ID to clear every privacy decision for one app. It's the manual page's own example:

tccutil reset All com.apple.Terminal

That app then asks again for each permission as it needs it. It's a clean start when you can't tell which permission is the problem.

After a reset

• Permissions macOS asks for, such as Automation, Camera or Microphone: the app gets the request again the next time it tries. Answer it as you like.
• Accessibility and Screen Recording: the app's entry is gone from the list, so turn the app on again in System Settings › Privacy & Security, adding it with the Add button (+) if it isn't there. Apple's guides for Accessibility and Screen Recording show where.
• Still stuck? Quit and reopen the app: some apps check their permissions only when they start.

Nothing else changes. Other apps keep their permissions, and the app keeps its settings and data. If an app still can't work with the permission on, see what to do when Accessibility is on but the app still can't work, or for Automation, how the Automation permission works.

With Flick

Flick, the window switcher we make, is com.flicknav.flick. Two resets are useful with it, and both only touch Flick's own entries.

Flick's switch is on but it shows no windows. Clear its Accessibility entry, then turn Flick on again in Privacy & Security › Accessibility, adding it with + if it isn't listed. Flick notices within a second, with no restart. Step by step: Accessibility is on, but Flick shows no windows.

tccutil reset Accessibility com.flicknav.flick

You want to answer the browser prompts again. With a license, Flick uses Automation for browser tabs, and macOS asks once per browser. This clears Flick's answers for every browser; then click Allow… next to each browser you use in Flick's Settings › Browser Tabs. Step by step: Flick isn't allowed to control a browser.

tccutil reset AppleEvents com.flicknav.flick

There's nothing to reset for Screen Recording or Input Monitoring: Flick never asks for either.