OpenClaw on Cloud Mac mini: macOS TCC Permissions for Accessibility, Screen Recording & Automation (2026)

OpenClaw-style agents on a rented Mac mini M4 in HK, JP, KR, SG, or US fail in boring ways: the daemon boots, logs look healthy, yet no window focus, no pixels, no keystrokes reach your automation target. Nine times out of ten the root cause is Transparency, Consent, and Control (TCC)—macOS refusing to wire Accessibility or Screen Recording until a human approves in System Settings. This 2026 guide gives a five-column permission matrix, a seven-step grant sequence, and hard numbers for log locations so you can finish setup once, then rely on LaunchAgent scheduling and Keychain-first secret hygiene without babysitting a laptop. Once those layers are stable, expand tool reach through MCP tool servers on Mac mini—each server inherits the same permission and secret boundaries you just enforced.

Why TCC is louder on cloud Macs than on your desk

On a personal Mac you click through prompts absentmindedly. On ProxyMac you often SSH first, which never surfaces the modal. Worse, some teams copy OpenClaw.app into ~/Downloads or a Dropbox-synced folder—macOS treats that as a different bundle path and silently revokes prior grants. The fix is procedural: /Applications, one interactive GUI session, then automation.

• Bundle stability: drag-install to /Applications before any plist references the binary.
• User parity: the UID that approves TCC must be the UID running launchd jobs—no “install as admin, run as staff.”
• Remote reality: Screen Recording prompts render on the physical console; over VNC they usually still work, but latency makes it easy to miss the corner overlay—read the VNC section below.

Permission matrix (what breaks when each gate is closed)

Scan this table during onboarding before you blame model latency or API quotas.

Gate	OpenClaw capability affected	User-visible symptom	First remediation	Notes
Accessibility	Clicking menus, typing into native Cocoa controls	Logs show “AXUIElementCreateApplication failed”	Toggle app in Accessibility list off/on after upgrade	Also gates many AppleScript bridges
Screen Recording	Pixel-based tools, browser canvas capture	Black frames or nil bitmap handles	Re-open privacy pane; macOS 15 may require re-approval after minor updates	Cannot be granted headlessly
Automation (Apple Events)	Scripting Safari/Chrome where supported	“Not authorized to send Apple events”	Approve per target app in Automation list	Pair with least-privilege browser profiles
Files & Folders (Downloads/Desktop)	Reading project trees, writing artifacts	ENOENT despite path existing in Finder	Grant explicit folders; avoid blanket Full Disk Access unless policy demands	Project repos under ~/Developer reduce scope creep
Microphone / Camera	Voice wake, meeting bots	Immediate OS alert or empty capture devices	Test with QuickTime once to prime prompts	Often skipped for pure text agents—still document “not used”

Seven-step grant sequence (do not reorder)

1. Reserve a GUI window: connect with Screen Sharing or use onsite KVM so someone can see the upper-right prompts.
2. Install to /Applications and delete stray copies elsewhere to avoid duplicate bundle IDs in the privacy lists.
3. Launch OpenClaw interactively once from Finder—not via sudo open—so the requesting process matches future LaunchAgents.
4. Walk Privacy & Security panes in this order: Accessibility → Screen Recording → Automation → Files (as needed) → Microphone/Camera.
5. Trigger a failing tool on purpose (e.g., a harmless screenshot) to force the OS to insert the app row if it did not appear automatically.
6. Reboot once; TCC caches are sticky and a restart separates “cached deny” from real policy.
7. Only now drop in the LaunchAgent from the unattended scheduling guide and verify logs under ~/Library/Logs or your chosen path.

LaunchAgents, loginwindow, and headless half-truths

Agents running under launchd inherit TCC decisions made by the same user after interactive approval. They do not inherit approvals granted while running as root during a mistaken sudo install—that mismatch produces the infamous “works in Terminal, fails in plist” split. Align UserName keys (if any) with the account that clicked Allow.

Remote VNC: making prompts visible without a flight to the data center

ProxyMac customers typically reach the mini over encrypted Screen Sharing. That is enough for TCC if compression is disabled temporarily (sharp text for tiny padlock icons), if nobody closes the privacy window mid-stream, and if you avoid nested “remote into remote” chains that shrink UI chrome below usable thresholds. Follow the VNC reference for bitrate guidance; pair with SSH vs VNC so engineers know when to drop to CLI-only workflows during lockdowns.

Three concrete numbers and where to look next

• Seven plist steps above map 1:1 to the HowTo JSON-LD embedded in this page—use them as acceptance criteria in your internal wiki.
• Three log families to tail after each permission change: the agent’s own log file, log stream --predicate 'subsystem == "com.apple.TCC"' (filtered to your test window), and /var/log/system.log snippets your security team already ingests.
• Five regions mean you may repeat onboarding once per metal host—script the checklist, but do not script clicking Allow; that is both brittle and contrary to Apple’s design.

FAQ

Can I grant Screen Recording over SSH only? No—macOS requires a graphical session for several prompts. Use VNC once, finish approvals, return to SSH.

Why did permissions break after cloning the disk? TCC ties approvals to bundle ID plus signature. Clones or drifted builds need re-approval.

Does LaunchAgent inherit the same TCC? Yes when it shares the same user bootstrap; no when UIDs differ or jobs run as root without GUI.

Why Mac mini on ProxyMac is the right metal for OpenClaw after TCC is settled

Agents are only as trustworthy as the hardware isolation underneath them. A dedicated Apple Silicon M4 Mac mini gives arm-native browsers, predictable single-tenant CPU for concurrent tool calls, and the same macOS stack Apple’s own frameworks expect—so when Screen Recording is on, you are capturing real Metal-backed surfaces, not emulated x86 quirks. Hosting in HK / JP / KR / SG / US lets you colocate automation with the APIs your business already calls, while ProxyMac’s SSH/VNC access model matches how platform teams debug TCC: shell for logs, GUI for consent. Renting instead of buying converts capital spend into time-bounded experiments—ideal for 2026 agent pilots that might pivot monthly.