tccd

An app is asking for a permission over and over, often because it was denied and keeps trying, or because it was updated and its signature no longer matches what tccd approved. Screen recording and Accessibility permissions are the common ones.

Less often the permissions database is in a bad state after a migration or an interrupted update, and tccd keeps failing to read it.

Open System Settings → Privacy & Security, find the permission the app needs, and switch it off and on again, or remove the app from the list with the minus button and let it ask again.

To reset one permission for every app, Terminal has tccutil reset followed by the service name, for example tccutil reset ScreenCapture. Apps will ask again the next time they need it.

When tccd is busy, the useful question is who is asking and for what. Its own log says both.

1. Open Activity Monitor, choose View → All Processes and type tccd in the search field. The User column shows root for the system instance and your name for yours. Note which one has the CPU.
2. Open Terminal and run log stream --predicate 'process == "tccd" AND eventMessage CONTAINS "AUTHREQ"'. Press Control-C to stop.
3. Read the lines that repeat. service= names the permission, such as kTCCServiceScreenCapture, and identifier= names the app, such as com.example.app.
4. Look at authValue= in the result lines. 0 means denied and 2 means allowed. An app that gets 0 again and again is the loop.
5. Reset that one permission for that one app. The part of the service name after kTCCService is what tccutil expects, so tccutil reset ScreenCapture com.example.app clears the answer for that app alone. tccutil reset All com.example.app clears every permission for it.
6. Open the app again and answer its prompt, or grant the permission in System Settings → Privacy & Security.

Normal: near zero, with a small blip each time an app asks for something protected. Apps ask often, but most answers come from the database in a moment.

Worth looking into: tccd stays in the CPU list for minutes at a time, or a permission you granted keeps asking again. The usual causes:

• An app that was updated or re-signed, so tccd no longer sees it as the app you approved.
• An app you denied that does not stop asking.
• A permissions database that did not move over cleanly during a migration.

Some permissions only take effect when the app starts. Screen Recording and Full Disk Access are the common ones: when you switch them on, macOS offers to quit and reopen the app. If you choose Later, the app keeps running as if it had no access until you quit it yourself.

If the switch is on and the app still cannot use the feature after a restart of the app, switch it off, remove the app from the list with the minus button, and add it again. That replaces the old record in tccd's database with one that matches the app as it is now.