{"version":"2.1.242","anchor":"an-every-app-grant-mode-that-must-ship-with-a-denylist","canonical_anchor":"an-every-app-grant-mode-that-must-ship-with-a-denylist","heading":"An every-app grant mode that must ship with a denylist","tier":"soon","area":"Computer Use","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242\/e\/an-every-app-grant-mode-that-must-ship-with-a-denylist","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242","markdown":"### An every-app grant mode that must ship with a denylist\n\nThere is a grant mode treating every app as allowed except ones on a denylist.\n\n**What**\n\nBesides granting named applications, there is now a mode that treats every application as granted at the full tier except those a denylist excludes, and it skips the step that hides windows before acting.\n\n**Details**\n\n- Constructing it with an empty denylist throws at runtime on purpose; the code calls that a wiring bug.\n- It is only used where the host program supplies an every-app policy. The default behaviour, granting specific apps, is unchanged.\n\n**Evidence**\n\n`WildcardGrantSet: deniedBundleIds must be non-empty`\n\n- Area: Computer Use\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}