The Gatekeeper Barrier
macOS includes a powerful security subsystem called Gatekeeper. When an employee downloads an application from the internet and attempts to open it, Gatekeeper intercepts the launch. It checks to see if the app was downloaded from the Mac App Store, or if it was cryptographically signed by an identified Apple Developer.
If the app is unsigned (often the case with in-house corporate tools or open-source software), Gatekeeper blocks it entirely, throwing a warning dialog that says the app “cannot be opened because the developer cannot be verified.”
Historically, users could bypass this by navigating to System Preferences > Security > “Allow apps downloaded from Anywhere.” However, in modern macOS, Apple completely removed the “Anywhere” button from the graphical interface to force compliance.
To restore that button, or to programmatically manage Gatekeeper exemptions across an enterprise fleet, IT administrators use the spctl (System Policy Control) command in the terminal.
1. Disabling Gatekeeper Entirely (Restoring “Anywhere”)
If you are setting up a developer workstation that needs to constantly compile and run unsigned code, the strict Gatekeeper rules are a massive hindrance.
You can use spctl to completely disable the Master Assessment subsystem (which restores the hidden “Anywhere” option in the System Settings GUI).
sudo spctl --master-disableAfter running this, the Mac will freely open any application downloaded from the internet without checking its cryptographic signature. (Note: This is highly discouraged for standard corporate employees, as it opens the machine to malware).
To instantly re-enable maximum security and hide the “Anywhere” button again:
sudo spctl --master-enable2. Auditing an Application’s Signature
If an employee complains that an application is being blocked, you can use spctl to forensically audit the app and determine exactly why Gatekeeper rejected it.
spctl --assess --verbose /Applications/CustomApp.appThe output will tell you if the app is “accepted” (properly signed and notarized by Apple) or “rejected.” If it is rejected, it will tell you if the signature is missing entirely, or if the cryptographic certificate has expired.
3. Adding Specific Exemptions
Instead of disabling Gatekeeper entirely with --master-disable, the correct enterprise solution is to leave security on, but explicitly whitelist the specific corporate application that is being blocked.
You can manually add an application to the Gatekeeper approval database using the --add flag.
sudo spctl --add /Applications/CustomCorpApp.appOnce this command is run (usually via an MDM deployment script right after the app is installed), Gatekeeper permanently trusts the application on that specific Mac, allowing the employee to double-click it without encountering any security warnings.
Conclusion
The spctl command is the definitive interface for macOS application security. By allowing MDM administrators to validate cryptographic signatures, manage system-wide assessment policies, and whitelist custom internal software, it ensures strict compliance without destroying developer productivity.