

Screenshot of a system alert that appears when Gatekeeper prevents an application from running, because it was not signed by an Apple certified developer. The system can also force this behavior upon individual applications using a signature-based system named Xprotect. This attribute is added by the application that downloads the file, such as a web browser or email client, but is not usually added by common BitTorrent client software, such as Transmission, and application developers will need to implement this feature into their applications and is not implemented by the system. Upon download of an application, a particular extended file attribute ("quarantine flag") can be added to the downloaded file. The command-line utility spctl provides granular controls, such as custom rules and individual or blanket permissions, as well as an option to turn Gatekeeper off. However, this option can be re-enabled by using the 'sudo spctl -master-disable' command from the Terminal and authenticating with an admin password. Since macOS Sierra, this option is hidden by default.

Anywhere Allows all applications to be launched. This is the default setting since Mountain Lion.

Mac App Store and identified developers Allows applications downloaded from the Mac App Store and applications signed by certified Apple developers to be launched. Mac App Store Allows only applications downloaded from the Mac App Store to be launched. In the security & privacy panel of System Preferences, the user has three options, allowing apps downloaded from: Since macOS Sierra, the "Anywhere" option is hidden by default. Gatekeeper options in the System Preferences application.
