I downloaded an app from the MacOS app store. Using
codesign, I can see that the app has a number of entitlements including:
Inside the app, one can choose which directories it has access to. Once selected by the user, the app will continue to have access to these directories (without asking the user again in the future).
Is there an administrative command-line (or graphical) security utility that allows me to see which exact directories (say which subdirectories of Documents) a sandboxed or notarised app has access to? I am assuming that MacOS somehow remembers this information.