macOS process library
What is syspolicyd on Mac?
syspolicyd is the System Policy daemon. It decides whether software may be installed, loaded, or run, and it’s the part of macOS behind Gatekeeper, which checks that new apps come from an identified developer, are notarized, and haven’t been altered.
- Part of
- macOS security, including Gatekeeper.
- Safe?
- Yes. It is part of macOS’s built-in protection against malicious software.
- Can I quit it?
- You can, but macOS starts it again right away. It protects your Mac, so leave it running.
The short answer
syspolicyd usually spikes for a short time when you open newly downloaded software, run an installer, or start a lot of new programs at once. Larger apps take longer to check. If it stays busy, an app that keeps launching the same code is the usual suspect.
Normal use
What syspolicyd usually looks like.
Most of the time syspolicyd idles with almost no CPU and a small amount of memory.
The first time you open a new app, it can briefly take noticeable CPU while the app is checked. That’s expected and doesn’t repeat on later launches of the same app.
Why syspolicyd uses so much CPU or memory
- Opening new software
Gatekeeper checks downloaded apps the first time they open. A large app has more code to verify.
- Installers and updates
Installing or updating apps brings new code that macOS checks.
- Lots of new programs at once
Development tools and scripts that run many newly downloaded or freshly built programs can give syspolicyd more to assess.
- An app that misbehaves
A broken or outdated app that keeps launching helpers or plugins can trigger repeated checks.
How to calm syspolicyd down
Start at the top. Each step is more disruptive than the one before.
- Wait for the first launch to finish
A spike when opening a new app usually ends in seconds to a minute.
- Check Privacy & Security
In System Settings → Privacy & Security, look at the Security section for an app that macOS has blocked. Only use Open Anyway for software you trust.
- Update or reinstall the app involved
Download the current version from the developer. A properly signed, up-to-date app is checked once and then left alone.
- Update macOS
Go to System Settings → General → Software Update.
- Restart
If syspolicyd stays busy with nothing new opening, a restart clears it.
Seeing it in Spare
Find what it’s reacting to.
syspolicyd spikes often line up with new code starting: a project installing dependencies, a dev server booting, or an AI agent running tools. Spare shows development projects and AI agents by project folder, so you can see what was starting up at the same moment.
Spare treats syspolicyd as a system task and never offers to stop it.
Common questions
About syspolicyd
Is syspolicyd a virus?
No. It is part of macOS security and checks software before it runs.
Can I disable syspolicyd?
You shouldn’t. It enforces Gatekeeper, one of macOS’s main protections against malware. Spikes are usually short.
Why does syspolicyd use CPU when I open a new app?
Gatekeeper checks downloaded software the first time it opens, to confirm it comes from an identified developer, is notarized, and hasn’t been changed.
Why does it run again after an app update?
An update replaces the app’s code, so macOS checks the new version too.
Related processes
Sources: Apple Platform Security: Gatekeeper and runtime protection, Apple: Open a Mac app from an unknown developer. Reviewed October 6, 2026.
Get Spare
Free to use. Yours to explore.
Download Spare for Apple silicon, or explore the MIT-licensed source on GitHub. Free to use, with no subscription or account.
macOS 14+ · Apple silicon · Signed and notarized