Glossary
TCC (Transparency, Consent, and Control)
TCC is the macOS privacy framework that governs app access to protected resources like Full Disk Access, camera, microphone and screen recording.
TCC (Transparency, Consent, and Control) is the macOS framework that decides whether an application may access protected resources such as the camera, microphone, screen recording, Accessibility, or Full Disk Access. When an app first requests such access, the user is prompted, and the decision is stored.
Decisions are kept in SQLite databases: a system-wide /Library/Application Support/com.apple.TCC/TCC.db and a per-user ~/Library/Application Support/com.apple.TCC/TCC.db. The access table records the service (for example kTCCServiceSystemPolicyAllFiles), the client, the authorization value and a last-modified time. Administrators can also pre-approve access through MDM configuration profiles (PPPC).
For investigators, TCC shows which permissions an app, including malware, obtained. See TCC database forensics.