top of page
Search

macOS 27 Shipped Monday: What Golden Gate Changes for Apple Intelligence on Your Fleet

Writer: MacSmithAI
MacSmithAI
Sep 15
7 min read

macOS 27 Golden Gate went out to everyone on Monday, 14 September. If you manage Macs, the headline feature is not the redesign or the performance work — it is that Siri AI, Apple's rebuilt assistant, is now sitting on every eligible machine in your fleet, in beta, on a release your users can install themselves this afternoon.


The old shape of an Apple Intelligence rollout was "we'll evaluate it next quarter." Golden Gate does not give you that. The features arrive with the OS, the OS arrives whether or not you have a plan, and the only question is whether your profiles got there first.


What actually shipped

macOS 27 is Apple silicon only — MacBook Air and MacBook Pro from 2020 onward, iMac from 2021, Mac mini from 2020, Mac Studio from 2022, Mac Pro from 2023. If you still have Intel Macs on the floor, they are not coming with you, and this is where that split stops being a slide in a roadmap deck.


On the AI side, Apple describes Siri AI as "a profoundly more capable and conversational assistant with personal context understanding, broad world knowledge, onscreen awareness, and even more systemwide app actions." Practically, that means three things land on the desktop: Siri can now draw on personal context across Messages, Mail and Photos; Visual Intelligence lets a user select a region of their screen with Command-Shift-Space and ask Siri about whatever is in it; and Shortcuts gained a "Describe a Shortcut" flow that assembles the steps from a natural-language prompt.


Read that middle one again with a security hat on. "Select a window of your screen and Siri can answer questions or take action with what's onscreen" is a screen-capture-plus-inference path that ships enabled, on a machine that may have a payroll report open. Not a reason to panic — a reason to decide something before your CISO reads the same sentence.


Apple is clear that Siri AI is a beta, rolling out in English first with French, Japanese, Korean, Portuguese and Spanish "next month." Apple's announcement says it "will not be available initially in the EU on iOS, iPadOS, and watchOS" — macOS is conspicuously missing from that list, and Apple's requirements page says EU users get Apple Intelligence through macOS 27. If you have EU staff, confirm on a real machine before promising anyone anything. It is also unavailable in mainland China.


The eligibility math nobody budgets for

Apple Intelligence needs an M1 or later Mac. That is the easy gate and most fleets clear it. The two underneath it are the ones that generate tickets.


First, the good features have a higher bar. Apple lists the advanced capabilities — expressive voices, the new dictation — as requiring a Mac with M3 or later and at least 12GB of unified memory. A base-spec M1 or M2 MacBook Air gets Apple Intelligence; it does not get everything your executives saw in the keynote. Second, and more practically: Apple's requirements page says Apple Intelligence consumes up to 14GB of storage on M3-and-later Macs with 12GB or more of memory, and up to 8GB on other eligible models.


Fourteen gigabytes. On a three-year-old 256GB MacBook Air already living at 85% full, that is a support ticket with your name on it. Run a storage report and find out how many machines have under 20GB free. At ten thousand devices the answer is never zero, and it is cheaper to know now than to learn it from Thursday's ticket queue.


One small thing generates disproportionate confusion: the device language and the Siri language must match. Users whose Mac is in English and Siri is not will simply not see the features, and will file a ticket saying Apple Intelligence is broken.


Two control surfaces, and you need to know which one you are on

Here is where most of the bad advice on the internet lives. There are two ways to restrict Apple Intelligence on a Mac, they are not equivalent, and "which keys do I use" depends on which one your MDM speaks.


The older surface is the Restrictions payload — com.apple.applicationaccess — carrying keys like allowWritingTools, allowGenmoji, allowImagePlayground, allowMailSummary, allowExternalIntelligenceIntegrations and allowExternalIntelligenceIntegrationsSignIn. These date back to macOS 15 and are broadly supported by MDM vendors today.


The newer surface is declarative. Apple's device management documentation lists com.apple.configuration.intelligence.settings, available on supervised devices running macOS 26.4 or later, carrying AllowGenmoji, AllowImagePlayground and AllowWritingTools — plus, new in the 27 releases, Apps.Calendar.AllowNaturalLanguageEditing for natural-language calendar event creation. Alongside it sit com.apple.configuration.external-intelligence.settings for third-party integrations and sign-in, com.apple.configuration.siri.settings for Siri itself, and com.apple.configuration.keyboard.settings.



Restrictions payload

Declarative Intelligence Settings

Identifier

com.apple.applicationaccess

com.apple.configuration.intelligence.settings

Example keys

allowWritingTools, allowGenmoji, allowImagePlayground, allowMailSummary

AllowWritingTools, AllowGenmoji, AllowImagePlayground, Apps.Calendar.AllowNaturalLanguageEditing

Minimum macOS

15.0 - allowMailSummary 15.1

26.4

Supervision

Full enforcement requires supervision; limited on user enrollment

Supervised devices only

In Intune

Not listed in Intune's Apple device-restrictions reference

Settings catalog - Declarative Device Management

Use it when

You still have pre-26.4 Macs in the population

Your fleet is supervised and on 26.4 or later


The Siri settings configuration is the one most people miss. It covers global Siri access, access on a locked device, whether user-generated content is processed, and profanity filtering — the only lever that touches Siri itself rather than the features hanging off it.


What you cannot turn off

Be honest with your security team here, because the gap is real. There is no single allowAppleIntelligence key. You cannot flip one switch and make the whole thing go away — you restrict feature by feature, and some features have no restriction at all. Clean Up in Photos, natural-language search in Photos, Memory movies and Smart Reply in Messages are all documented by Mac admins as unmanageable today.


There is also a supervision cliff: the declarative configurations require supervised devices. If a meaningful slice of your fleet is user-enrolled — BYOD, contractors, acquisitions you have not finished absorbing — enforcement on those machines is materially weaker than on your Automated Device Enrollment population. That belongs in your risk register, not a footnote.


If you are on Intune, the settings live in the settings catalog under Declarative Device Management, in categories named Intelligence Settings and External Intelligence Settings. Worth knowing: Microsoft's published Apple settings-catalog reference does not list either category, while a Mac-admin walkthrough from late August shows them in the console for iOS and iPadOS. The docs are behind the product — confirm what is actually in your tenant for macOS rather than trusting the reference page or this post.


The change that will actually break your week

Buried in Apple's enterprise release notes is the line that matters more than any of the above: legacy software update management no longer functions in all 27.0 operating systems. Not deprecated — no longer functions. Commands, queries, update cadence settings and the associated restrictions are gone, and Apple's instruction is to move to declarative software update management.


If your update policies still run through the old MDM workload, they stopped working on Monday. Not loudly, not with a dashboard error — they will simply have no effect, and you will find out weeks later when a compliance report shows a population of Macs sitting on 26.x. Check this today. It is the highest-value ten minutes in the entire release.


Three other items deserve a look: tccutil list now reports privacy authorizations on managed devices, apps can no longer read the local TCC database directly, and macOS 27 adds OS-level control over which apps and binaries can run. That last one is the most interesting lever a Mac admin has been handed in years, and the obvious place to think about unsanctioned AI tooling.


The data-path question your security team will ask

You will be asked where the inference happens, so keep the answer precise. Apple says Siri AI runs with on-device processing and Private Cloud Compute, and that personal data handled by Private Cloud Compute is "not stored nor made accessible to Apple or anyone else."


The part people will press you on is Google. On Apple's January 2026 earnings call, Tim Cook described the personalised Siri as "a collaboration with Google," said Google's technology "would provide the most capable foundation" for Apple's foundation models, and said Apple will "continue to run on the device and run in Private Cloud Compute and maintain our industry-leading privacy standards." He also said plainly that Apple was not releasing the details of the arrangement.


So the position that survives a follow-up question is this: the processing stays within Apple's on-device and Private Cloud Compute boundary, the underlying model work involves Google, and the contractual specifics are not public. Do not tell your security team "it's all on-device," because it is not. Do not tell them "Google sees your data," because Apple says otherwise. Tell them what is documented and name what is not.


The practical takeaway

Do these four things this week, in this order.


One: verify your software update policies. Confirm you are on declarative software update management. If you are not, that is the migration to start today, not the one to schedule. Everything else here can wait a week; this cannot.


Two: ship a restriction profile before the upgrade wave, not after. Use the declarative Intelligence Settings configuration if your fleet is supervised and on 26.4 or later, which after this week most of it will be. Do not start from "block everything" — start from something defensible: allow Writing Tools, block external intelligence integrations until you have an approved provider, and make a deliberate decision about Visual Intelligence's onscreen awareness rather than inheriting one.


Three: run the storage report. Up to 14GB per machine is a real capacity question at fleet scale, and you want that number before the tickets arrive.


Four: write down what you told your security team, Google ambiguity included. When Apple publishes more detail — and it will — you want a dated record of what was known on 15 September 2026 rather than an argument about what someone remembers promising.


The thing not worth doing is what most organisations will do, which is wait and see. Siri AI is on those Macs now. "We haven't decided yet" is itself a decision, and it is the permissive one.



Comments

bottom of page