The Apple Application Block Policy allows administrators to block specific applications, scripts, and binaries on macOS devices based on developer identity, application identifiers, file paths, names, or even window titles. This provides fine-grained control to prevent the use of unauthorized or risky software, including command-line tools and scripting runtimes.

This policy supports BYOD macOS devices.

With new authorization from Apple, the Apple Application Block Policy has expanded its blocking scope. Previously, this policy only blocked GUI-based applications. Now, scripts and binaries are also blocked. This means you can enforce security policies against command-line tools, scripting runtimes, and background services — not just apps with a graphical interface.

No new policy fields were added. The existing configuration settings (Team ID, Identifier, Path, Name, and Window Title) now apply to a broader range of executables.

With the Apple Application Block Policy, you can:

When a blocked application, script, or binary is launched, macOS will immediately prevent it from running.

Navigate to:

Device Management → Policy → Create New Policy → Apple Application Block Policy

Blocks applications signed by specific Apple developer Team IDs.

Example use case:
Block all software published by a known vendor.

💡 You can find a Team ID using:

Blocks applications and binaries using their bundle identifier or code signing identifier.

Example (applications):

💡 Tip for scripts and binaries: Many scripts run through an interpreter (e.g., Openclaw runs via node). You can find the signing identifier of the parent process using:

For example, blocking node by its signing identifier will also prevent any Node.js-based tools (such as Openclaw or other npm/npx packages) from executing.

This method is precise and recommended for blocking well-known applications and runtimes.

Blocks applications and binaries located at specific file paths.

Example (applications):

Example (scripts and binaries):

⚠️ Blocking a directory path will block all applications and binaries inside that directory.

Blocks applications and processes whose names contain a specific string.

Example:

This is useful when application names vary by version, or when you want to broadly block a scripting runtime by name.

Blocks applications by detecting specific window titles.

This is an advanced option, useful when:

How to Find a Window Title:

If you don't know the window title:

Example:

In the logs, you will see entries like:

Enter Add Printer into the Check App Window Titles field. When the window opens, it will be automatically closed.

Tools installed via npm/npx (such as Openclaw and other LLM CLI agents) run through the node binary. Blocking node will prevent all Node.js-based tools from executing.

Note, please test this on test devices before distributing it. Because things that will be blocked might have different side effects. For example, if Python is blocked, Swif's software package won't work because Swif uses Python for app management.

Use the same approach for any scripting runtime or CLI binary:

When used together with the Apple Tracking Policy (App Blocking Tracking), blocked script and binary execution attempts are reported as tracking events. This gives you visibility into:

Events are visible in Device Management → Event Logs → Device Events.

If you need help identifying application identifiers, Team IDs, script runtime paths, or window titles, contact Swif Support or use Live Terminal for inspection.