Engineering case study 03 · macOS permissions

Why an unreadable folder must not look empty.

A plausible-looking subtotal can be more dangerous than an obvious error. Klyr tests denied and excluded paths as evidence that a storage scan is partial.

12disk-usage scanner tests passed
4 statescomplete, partial, access-limited, cancelled
0 bytes ≠ emptywhen enumeration was denied

The false-zero problem

If macOS refuses access to a folder, an implementation can accidentally return no children and zero bytes. The arithmetic may be internally valid, but the conclusion is false: the scanner learned nothing about the folder’s contents.

Klyr carries completeness evidence alongside the size tree. Access failures, intentional policy exclusions, an inaccessible root and cancellation all affect the final state.

The controlled cases

CaseFixtureExpected behavior
Readable treeOrdinary directory containing a fileComplete, zero access issues and correct size.
Denied subtreeNested directory with POSIX permissions set to 000Not complete; access issue count is greater than zero.
Intentional exclusionA .Trash directory inside the selected rootPartial, with one policy exclusion rather than a complete result.
Collapsed deep branchFile below the configured tree depthChildren collapse, but their measurable size still reaches the parent.

Why Klyr does not use a “Full Disk Access is on” badge as proof

macOS does not provide a general public API that guarantees an application can read every path. Full Disk Access is a TCC permission that can broaden access to privacy-protected data, but other controls still exist: filesystem permissions, ACLs, System Integrity Protection, sealed volumes, encryption, cloud availability and ownership boundaries.

Klyr Pro can guide a user to the relevant System Settings pane after an actual denial. The verification step is another scan. If the requested paths become readable, the warning disappears; if failures remain, so does the partial result.

What Klyr records about denied paths

The scan result retains aggregate access-issue and exclusion counts. Protected paths are not persisted or sent as telemetry. This preserves the information needed to explain completeness without turning inaccessible filenames into diagnostic data.

Observed result

All 12 current DiskUsageScanner tests passed on the arm64e macOS 14 test target. The readable fixture was complete, the locked subtree produced an access issue, the intentionally skipped Trash directory produced a partial result, and collapsed branches preserved their measurable total.

What this result does not prove

A unit fixture cannot enumerate every privacy rule or macOS release behavior. Root privileges are not equivalent to authorization, cloud content may not exist locally, and an APFS namespace walk is not container accounting. Klyr’s contract is to expose known incompleteness—not to claim that a successful scan measured every physical block.

Product decision

Klyr treats completeness as product data, not a debug detail. A denied location does not silently become a trustworthy zero-byte folder. Lite stays within user-selected sandbox scope; Pro can request broader macOS-controlled access while continuing to report what it could not measure.

Read the Mac System Data guide and storage analyzer methodology.