<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!--
  Nucleic VM agent — Privacy Preferences Policy Control (PPPC) profile.

  Grants Full Disk Access (SystemPolicyAllFiles) and Network Volumes access to the in-guest agent
  (xyz.blakeslee.nucleic.vmagent), which supersedes the per-folder "Files &
  Folders" data-access checks and lets agent execs touch custom-mounted VirtioFS workspaces without
  a GUI consent sheet. This removes the recurring boot-time banner:

      "Data Access Blocked — NucleicVMAgent tried to access your data from
       other apps and was blocked."

  IMPORTANT — PPPC payloads are ONLY honored when the profile is delivered
  through an approved MDM (user-approved MDM or Automated Device Enrollment).
  A manually-installed PPPC .mobileconfig is IGNORED by TCC on macOS 10.15+.
  The golden-base provisioning flow must therefore install this profile through
  Nucleic's integrated MDM before it treats either permission as ready.
-->
<plist version="1.0">
<dict>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadIdentifier</key>
    <string>xyz.blakeslee.nucleic.pppc.vmagent</string>
    <key>PayloadUUID</key>
    <string>e5bc298e-77a8-473a-a84e-8faee7297561</string>
    <key>PayloadDisplayName</key>
    <string>Nucleic VM Agent — File Access</string>
    <key>PayloadDescription</key>
    <string>Grants Full Disk Access and Network Volumes access to the Nucleic in-guest agent so app data and VirtioFS workspaces do not raise permission prompts.</string>
    <key>PayloadOrganization</key>
    <string>Nucleic</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadEnabled</key>
    <true/>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.apple.TCC.configuration-profile-policy</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadIdentifier</key>
            <string>xyz.blakeslee.nucleic.pppc.vmagent.tcc</string>
            <key>PayloadUUID</key>
            <string>94c5cf03-9a37-44fd-bcbc-2b435356f4bb</string>
            <key>PayloadDisplayName</key>
            <string>Privacy Preferences Policy Control</string>
            <key>Services</key>
            <dict>
                <key>SystemPolicyAllFiles</key>
                <array>
                    <dict>
                        <key>Identifier</key>
                        <string>xyz.blakeslee.nucleic.vmagent</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                        <key>CodeRequirement</key>
                        <string>identifier "xyz.blakeslee.nucleic.vmagent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = L7UDTQ6F5W</string>
                        <key>Authorization</key>
                        <string>Allow</string>
                        <key>StaticCode</key>
                        <false/>
                        <key>Comment</key>
                        <string>Nucleic in-guest computer-use agent</string>
                    </dict>
                </array>
                <key>SystemPolicyNetworkVolumes</key>
                <array>
                    <dict>
                        <key>Identifier</key>
                        <string>xyz.blakeslee.nucleic.vmagent</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                        <key>CodeRequirement</key>
                        <string>identifier "xyz.blakeslee.nucleic.vmagent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = L7UDTQ6F5W</string>
                        <key>Authorization</key>
                        <string>Allow</string>
                        <key>StaticCode</key>
                        <false/>
                        <key>Comment</key>
                        <string>Nucleic in-guest agent access to VirtioFS workspace mounts</string>
                    </dict>
                </array>
            </dict>
        </dict>
    </array>
</dict>
</plist>
