Meta's Muse and the gap between a toggle and a real control
Meta's defense of Muse rests on a connector toggle. Muse only reads Messages if Full Disk Access is granted and the connector is enabled, says the CTO. Apple's reply, naming no one, is that Full Disk Access exposes everything on the system, messages included. That's the gap I see in most agent access reviews. Teams document what the app promises to do and skip what the permission actually allows. A toggle inside the app is a product feature. The OS grant is the control. When I'm approving an agent, I ask what it can reach if the vendor's good intentions fail. What did your last agent approval actually check?
Source: Apple changes full-disk access permissions to curb abuse from AI agents (Ars Technica)