The question was more about _should_, than _does_, and there's all sorts of places it currently breaks down. For example, say you use pass [0], it's just a Bas

The question was more about _should_, than _does_, and there's all sorts of places it currently breaks down. For example, say you use pass [0], it's just a Bash script. You want it to be able to access pbcopy/pbpaste, for basic functionality to work. You don't want to give it permission every time. However, you probably don't want sh to be able to access pbcopy/pbpaste without permission. Scripts themselves should hold certain permissions, but those permissions are currently held by their host application, because sh /usr/local/bin/pass isn't identified by the system as an application. The app is still considered to be sh. [0] https://www.passwordstore.org/ https://www.passwordstore.org/