Gatekeeper

Gatekeeper is the macOS security mechanism that verifies software before it runs for the first time. When a user opens a file carrying the quarantine attribute, Gatekeeper, implemented largely by the syspolicyd daemon, checks that the code is validly signed and, on current macOS versions, notarized by Apple. XProtect signature checks may also apply.

Analysts can evaluate a binary with spctl --assess --verbose <path> and inspect its signature with codesign -dv <path>. Gatekeeper decisions and user overrides are recorded in the unified logs, which helps establish whether a user deliberately bypassed a warning.

Gatekeeper is not a full anti-malware system and does not assess files that were never quarantined. See Quarantine events and Gatekeeper.