macOS processes › Security and privacy
What is syspolicyd on Mac?
syspolicyd is the macOS system policy daemon behind Gatekeeper. It checks the apps you open, especially newly downloaded ones, to confirm they're signed, notarized by Apple and allowed to run.
What it does
The first time you open an app from the internet, syspolicyd checks its signature and notarization and records the result, so later launches are quick. It enforces the setting in System Settings › Privacy & Security that controls which apps are allowed, and works alongside XProtect's malware checks.
Why it gets busy
- Opening a large app for the first time, which means checking many files.
- Installing or updating several apps at once.
- Developers running freshly built, unsigned programs over and over.
- A slow connection during an online notarization check.
Why is syspolicyd using so much CPU?
syspolicyd is checking apps before they run. It's busiest the first time you open large or newly downloaded apps, and it settles once they're verified.
Is it safe to quit?
macOS restarts it and the check starts again. It's part of your Mac's protection.
The genuine syspolicyd is at /usr/libexec/syspolicyd.
How to calm it down
- Give it a minute the first time you open a big app.
- After installing several apps, open them one at a time.
- If you're a developer and your Mac shows a Developer Tools section in System Settings › Privacy & Security, adding Terminal there skips some checks for programs started from Terminal. Only do it if you understand the trade-off.
In SystemWatch
SystemWatch's History shows syspolicyd's spikes lining up with app installs, so you can tell security checks apart from a real problem.
