syspolicyd on Mac: Gatekeeper's checker, why it is busy, and what to do

What syspolicyd does

Every time you open something new on a Mac, macOS asks a question: is this allowed? Gatekeeper is the name for the answer, and syspolicyd is the daemon that works it out. It reads your choice in System Settings under Privacy & Security (App Store only, or App Store and identified developers), checks the app's code signature, looks up its notarization ticket, and consults the quarantine flag that Safari and other apps put on downloads. If everything lines up, the app opens. If not, you get the dialog about an unidentified developer or an app that cannot be checked for malicious software.

The expensive part is the signature check. To confirm that nothing has been tampered with, syspolicyd has to read every file in the app bundle and compare it against the signature. For a small utility that is a few hundred files and a second or two. For Xcode, with hundreds of thousands of files and tens of gigabytes, it is minutes of flat-out CPU and disk, which is why developers see this process more than anyone.

It also handles installer packages, disk images, scripts and command-line tools, and it keeps a cache of what it has already approved so the second launch is instant. That cache is why a big app is slow to open once and fast after that.

What normal looks like

syspolicyd is bursty by design. Most of the day it does nothing; when it works, it works hard and briefly:

The one widely shared MacRumors report on this is a good example of the last row: a user on Catalina found syspolicyd scanning a 12 GB Monterey installer every few minutes, and deleting the file solved it. That is the shape of nearly every real syspolicyd complaint. There is a large signed thing on disk that keeps getting evaluated.

Why syspolicyd is using CPU right now

1. You just opened an app for the first time. Or the first time since it updated. The check runs once and is cached. Normal.
2. You installed Xcode, a large game, a creative suite or a virtual machine app. Huge bundles take minutes to verify. Developers see this after every Xcode update, and it is the single most common reason for a long syspolicyd run.
3. A macOS update just finished. Approval caches are rebuilt and many apps are re-checked on their next launch, so the first day after an update has more syspolicyd activity than usual. It fades as you use your apps.
4. A large installer is sitting in Downloads. A macOS installer, a 10 GB disk image, or a folder of installers can be re-evaluated whenever something touches it, including Spotlight. Moving it out of Downloads or deleting it ends the loop.
5. A build or script tool is launching many binaries. Package managers, build systems and test runners spawn thousands of small executables, each of which is assessed. This is normal during a build and stops when the build does.
6. Something is blocking the online check. Notarization lookups go to Apple over the network. A VPN, a firewall or a captive portal that blocks them can leave syspolicyd waiting or retrying and app launches hanging.

Is it safe to quit syspolicyd?

No. It runs as root, Activity Monitor will ask for your password, and launchd restarts it within a second. Worse, if an app launch was waiting on it, that launch can hang or fail, and the next attempt starts the check from scratch. You cannot turn Gatekeeper off from System Settings either, and the methods that disable it from the command line remove a real protection for no benefit here.

The right mental model is that syspolicyd is doing a one-time job on something large. Let it finish, or remove the large thing. Nothing else is needed.

Check any process above. For syspolicyd the verdict is settle: it stops when the check is done.

What to do, in order

1. Wait out the first launch

   If you just opened a big app or installed Xcode, give it the full few minutes. The Dock icon bouncing or a spinning cursor during this is normal. Do not force quit the app; that only restarts the check.

2. Look in Downloads for huge installers

   Open Downloads and sort by size. A macOS installer, a multi-gigabyte disk image or a large package there is the most common cause of repeated scans. Move it to an external drive or delete it once you have used it.

3. Eject disk images you are done with

   A mounted installer image can be re-checked repeatedly. Eject it from Finder and delete the file if the app is installed.

4. Finish the update cycle

   After a macOS update, open the apps you use once each so their approvals are rebuilt and cached. The first day is busier; the second is normal. Mac slow after update covers the rest of that first day.

5. Check the network if launches hang

   If apps bounce for a long time and then open, or show a dialog about not being able to check for malware, disconnect the VPN or switch Wi-Fi and try again. The notarization lookup needs a clear path to Apple.

6. Restart

   A restart clears any stuck evaluation and lets the caches settle. If syspolicyd is quiet after the restart and stays quiet, you are done.

7. If it repeats with nothing new, find the file

   Select syspolicyd in Activity Monitor, click the i button, and open Open Files and Ports. The path it is reading is the item being scanned. Move or delete that item. Do not remove anything inside System or Library folders.

When to worry

Busy syspolicyd is not a sign of infection; it is the opposite, the system checking things. These are the situations that deserve a second look:

• Every app launch is slow for more than a day or two after an update, which can mean the approval cache is not being written. Free up disk space and restart.
• syspolicyd runs hot every few minutes for days with Downloads empty and no builds running. Use the Open Files tab to find what it is reading.
• You are repeatedly asked to approve an app you already approved. That points at a corrupt quarantine record on the file; re-downloading the app fixes it.

None of these are reasons to weaken Gatekeeper. Keep the setting on App Store and identified developers, and let syspolicyd do its job.

Because the work is bursty, a single Activity Monitor glance can catch it at 100 percent and mislead you. Safe to Quit watches each process over hours, so a syspolicyd that fires once after an Xcode update looks very different from one that fires every five minutes all day.