syspolicyd

It is checking code. Opening a large app for the first time, installing software, or unpacking archives full of executable files gives it more to check. Developers may see more activity when building and running many new binaries.

Usually nothing. Let the install or first launch finish and the activity should stop. Do not try to disable it or the security checks it performs. If it stays busy for a long time with nothing happening, restart the Mac.

The Apple features syspolicyd supports check an app's signature and, for downloaded software, whether it is notarized. That means its activity follows code arriving on your Mac.

Files you download get a quarantine flag that tells macOS to check them the first time they are opened. Once an app has been checked and allowed, later launches do not need the same first time review, which is why the activity is concentrated around new software.

• Opening an app downloaded from the internet for the first time.
• Installing or updating apps, including large ones with many bundled components.
• Unpacking archives or disk images that contain apps or command line tools.
• Developer work that produces and runs many new executables, such as builds and package installs.

Two read-only commands show what the system policy thinks, without changing anything. They are useful when you want to know whether an app is signed and notarized before you open it.

1. Run spctl --status. It prints assessments enabled when Gatekeeper checks are on, which is the normal state.
2. Run spctl --assess -vv /Applications/AppName.app with the path to an app. The output says whether the app is accepted, and a source= line such as Notarized Developer ID or Apple System that tells you why.
3. To see whether a downloaded file still carries the quarantine flag, run xattr -l ~/Downloads/FileName. A com.apple.quarantine entry means macOS will check it when it is first opened.

Do not turn off Gatekeeper, disable System Integrity Protection, or quit syspolicyd to save CPU. Those changes remove checks that stop untrusted software from running, and syspolicyd would not stay stopped anyway.

Do not strip the quarantine flag from downloads with xattr to skip the first launch check either. That flag is what makes macOS look at software from the internet before it runs, and removing it bypasses that check without making the Mac any faster in daily use.

If macOS blocks an app you trust, open it the supported way: after trying to open it, go to Apple menu > System Settings > Privacy & Security, scroll down, and click Open Anyway. The app is saved as an exception and opens normally from then on.

Normal: short bursts of CPU when you open, install or unpack software, which end once the work is done. Developers see more of it, because every new build of a tool or app is new code that may need checking.

Worth looking into: syspolicyd stays busy for a long time while you are not installing or opening anything. Check whether something is installing in the background, such as an app updater, and let it finish. If the activity continues with nothing going on, restart the Mac.