Entitlements (macOS)

Entitlements are macOS's declared-permissions system: key-value flags baked into an app's code signature that state what the app is allowed to do, network access, file access, camera and microphone use, JIT compilation, and so on.

For Mac App Store apps they're mandatory and strict, because store apps run inside the App Sandbox: anything not declared is denied at runtime. Electron apps need a specific set (JIT and unsigned-executable-memory allowances) just to run, plus whatever the app's features require. Direct-distribution apps use entitlements more loosely, mainly alongside the hardened runtime for notarization.

The debugging experience is unforgiving: a missing entitlement doesn't produce a clear error, it produces an app that crashes on launch or a feature that silently fails, only in the store build. The declared set must also stay consistent with the provisioning profile.

Deskifier manages the Electron-required entitlements automatically for Mac App Store builds and exposes the feature-level ones (like network client or file access) as configuration, so store builds run without hand-editing plist files.