An entitlement defines an application's relationship with a platform capability. Security review should preserve necessary capabilities while limiting unnecessary sharing and access.
Evaluation approach
Review the permissions of the application, extensions and auxiliary targets separately. Compare source settings with the entitlements in the final signed package.
Application example
After adding an SDK, check that Keychain or app-group access has not expanded unnecessarily.
Limits and considerations
A capability visible in the project is not guaranteed to appear in the same form in the distributed package.
Requested capabilities and actual needs
Investigate unnecessary entitlements during integration review. An incorrect necessary entitlement can also cause production failures. Source-project settings alone do not represent the final package.
Read the main application's entitlements together with those of its extensions. For shared storage or key access, document exactly which components can access each data item. Entitlement changes introduced by a new SDK should be visible during release review.
Checks and decisions
- Review every target
- Remove unnecessary entitlements
- Compare signed outputs
Assess differences between development and release packages through functional tests.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.