<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!--
BeProof PPPC reference template (M1).
Before deployment:
1. Replace __TEAM_ID__ with your Apple Developer Team ID.
2. Replace __UUID_*__ placeholders with fresh UUIDs (uuidgen).
3. Sign with your MDM vendor or: profiles sign -s "Developer ID Application: …" …
4. Scope File-access rules to approved scan roots only.
See docs/deploy/PPPC.md for service descriptions and CLI caveats.
-->
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadType</key>
<string>com.apple.TCC.configuration-profile-policy</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadIdentifier</key>
<string>com.beproof.pppc.tcc</string>
<key>PayloadUUID</key>
<string>__UUID_TCC__</string>
<key>PayloadDisplayName</key>
<string>BeProof Privacy Preferences</string>
<key>PayloadDescription</key>
<string>Pre-approves BeProof file access for managed deployment pilots.</string>
<key>PayloadOrganization</key>
<string>Your Organization</string>
<key>Services</key>
<dict>
<key>SystemPolicyDocumentsFolder</key>
<array>
<dict>
<key>Identifier</key>
<string>com.beproof.app</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>CodeRequirement</key>
<string>identifier "com.beproof.app" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "__TEAM_ID__"</string>
<key>Allowed</key>
<true/>
<key>Comment</key>
<string>Documents folder — only if approved scan roots include ~/Documents paths.</string>
</dict>
</array>
<key>SystemPolicyDownloadsFolder</key>
<array>
<dict>
<key>Identifier</key>
<string>com.beproof.app</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>CodeRequirement</key>
<string>identifier "com.beproof.app" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "__TEAM_ID__"</string>
<key>Allowed</key>
<true/>
<key>Comment</key>
<string>Downloads folder — optional; disable if not in approved scan roots.</string>
</dict>
</array>
</dict>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>BeProof PPPC (Reference)</string>
<key>PayloadIdentifier</key>
<string>com.beproof.pppc</string>
<key>PayloadOrganization</key>
<string>Your Organization</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>__UUID_ROOT__</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
