Configure macOS binary allowlisting for Workbrew

macOS 27 adds a new feature for device management in com.apple.configuration.app.settings that lets you control which binaries are allowed to run on a supervised Mac. The AllowedBinaries key matches binaries by Team ID, Signing ID, CD hash, or path so it covers command line tools as well as apps.

Once a Device has an AllowedBinaries list, only binaries that match an entry can run and everything else is blocked. Binaries that are part of the signed and sealed system volume are always allowed. You'll want to add entries for Workbrew's own binaries before you enable this restriction on a fleet that runs Workbrew.

Add Workbrew to your allowlist#

Workbrew signs the Workbrew Agent and its bundled tools with Team ID 676JW3JDLF. A single entry scoped to this Team ID and to /opt/workbrew/ covers the Agent binary (com.workbrew.workbrew-agent) and the bundled Git tools (com.workbrew.git, com.workbrew.git-credential-workbrew). When using a Team ID to match binaries, additional software bundled by Workbrew would be allowed in the future.

{
  "AllowedBinaries": [
    {
      "TeamID": "676JW3JDLF",
      "PathPrefix": "/opt/workbrew/",
      "SigningState": "DeveloperID",
      "Description": "Workbrew Agent"
    }
  ]
}

Portable Ruby entry needs its own SigningID because that binary lives under Homebrew's own prefix and not /opt/workbrew/. Homebrew uses this Ruby to run brew and without it brew will fail to run under an AllowedBinaries restriction even though the Workbrew Agent is allowed.

{
  "AllowedBinaries": [
    {
      "TeamID": "676JW3JDLF",
      "SigningID": "com.workbrew.ruby",
      "PathPrefix": "/opt/homebrew/Library/Homebrew/vendor/portable-ruby/",
      "SigningState": "DeveloperID",
      "Description": "Homebrew Portable Ruby"
    }
  ]
}

You'll want to add both keys to your allowlist. If your device management service supports it, you may be able to paste the full reference JSON directly.

Verify your allowlist#

After deploying the declaration, confirm a check-in on an affected Device. Then confirm brew still runs and the Workbrew Agent is checking in to the Workbrew Console.

Related docs#

• Configure endpoint privilege management for Workbrew - the same "what to allow under a new OS-level restriction" problem, for EPM tools instead of macOS's own binary allowlisting
• How the Workbrew Agent uses elevated privileges - why the Agent needs the paths and privileges this allow list grants it
• Why we recommend FQDN-based allowlisting - the reasoning behind matching by stable identity instead of a value that changes on every rebuild
• How to block cask self-installs - another allow/deny control for a different installation surface