Profile clarification

[b0gdanw]

According to Apple’s documentation, the Apple Intelligence restrictions have been depreciated in macOS 26.4 and above, and the new IntelligenceSettings require declarative management.
So, what exactly does the profile installed by RemoveMacAI use to turn off Apple Intelligence?

Device Management Profile - Restrictions
https://developer.apple.com/documentation/devicemanagement/restrictions
Object - IntelligenceSettings
https://developer.apple.com/documentation/devicemanagement/intelligencesettings
Web Service Endpoint - Declarative Management
https://developer.apple.com/documentation/devicemanagement/declarative-management

[omlahore]

You're right that Apple marked those keys deprecated in 26.4. The profile still uses them, in a Restrictions payload with allowWritingTools, allowGenmoji, allowImagePlayground, allowAssistant and the rest. It also forces preferences for the parts that have no restriction key (Siri's own switches, notification and Messages summaries, inline predictions and Spatial Photos), and it points the model downloads at a closed local port.

IntelligenceSettings is a declarative management configuration, so it has to come from an MDM server, and a profile you install yourself can't carry it. Without MDM the deprecated keys are the only way I know of to lock these.

On macOS 27.0 (26A428) they still work as far as I can tell. With the profile installed, macOS adds _isAppleIntelligenceRestricted = 1 to the managed restrictions and fills in two settings the profile never sets, Assistant Allowed = 0 in com.apple.ironwood.support and DisableImagePlaygroundiCloudSetting = 1. NSWritingToolsCoordinator.isWritingToolsAvailable and ImagePlaygroundViewController.isAvailable both return false too, though with the models deleted that part doesn't prove much on its own. If a later release stops honoring the keys, that's where this breaks, and I don't have a way around it without MDM.

[sxflynn]

Are you using AI to write your replies?

[tully-8888]

Some details to add, from Apple's docs and from a test on macOS 27.0.1 (26A434):

What Apple's docs say

• All 13 Restrictions keys in the profile (allowWritingTools, allowGenmoji, allowImagePlayground, allowAssistant, allowDictation, allowMailSummary, allowMailSmartReplies, allowSafariSummary, allowNotesTranscription, allowNotesTranscriptionSummary, allowAppleIntelligenceReport, allowExternalIntelligenceIntegrations, allowExternalIntelligenceIntegrationsSignIn) are marked "Deprecated: macOS 26.4+". On macOS, none of them is marked as requiring supervision, so an unsupervised Mac still accepts them.
• IntelligenceSettings (com.apple.configuration.intelligence.settings) is allowed only in supervised enrollment. Device enrollment, user enrollment and local enrollment are all "N/A". So even a Mac enrolled in MDM can't use it unless it is supervised (Apple Business/School Manager or Apple Configurator).
• The ChatGPT keys move to a separate declaration, com.apple.configuration.external-intelligence.settings.

What the Mac does with the profile installed (27.0.1)

• /Library/Managed Preferences/com.apple.applicationaccess.plist has all the keys above set to 0, plus _isAppleIntelligenceRestricted = 1.
• /Library/Managed Preferences/com.apple.ironwood.support.plist has Assistant Allowed = 0, which the profile doesn't set.

Two layers that don't depend on the deprecated keys

1. The model download block uses forced preferences (DownloadServerBaseURLOverride-<asset type>), not Restrictions keys.
2. Apple Intelligence eligibility. macOS stores it in /private/var/db/eligibilityd/eligibility.plist, domain OS_ELIGIBILITY_DOMAIN_GREYMATTER. One input is DEVICE_AND_SIRI_LANGUAGE_MATCH. I tested this with the profile removed and Siri set to a language that differs from the device language (English (Canada) Siri, English (US) device), so the Mac was not eligible. In 26 minutes, no model downloaded. After I made the Mac eligible again, downloads started within about 5 minutes.

So if a later release stops honoring the deprecated keys, making the Mac ineligible still keeps the models off without MDM. The Siri language can only be changed in System Settings (assistantd rejects the change from a non-Apple process), so the user has to pick it. I plan to propose this as an opt-in option, with an explanation for the user, in a later PR.

[omlahore]

I didn't know IntelligenceSettings was supervised only, I'd assumed any MDM could push it. I said above I don't have a way around it if the keys stop working, and I think the eligibility thing gets around that, at least for the downloads. Opt-in sounds right for it since people have to change the Siri language themselves. Thanks for testing all this.

[b0gdanw]

Thank you for the clarifications.
I see now that removemacai off --dry-run generates a profile that can be viewed:
There might be an error: <key>kept</key> is present, but not set.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Apple Intelligence restrictions</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.restrictions</string>
			<key>PayloadType</key>
			<string>com.apple.applicationaccess</string>
			<key>PayloadUUID</key>
			<string>FC69A131-23A4-558C-8C21-343E1DDC8A69</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>allowAssistant</key>
			<false/>
			<key>allowExternalIntelligenceIntegrations</key>
			<false/>
			<key>allowExternalIntelligenceIntegrationsSignIn</key>
			<false/>
			<key>allowGenmoji</key>
			<false/>
			<key>allowImagePlayground</key>
			<false/>
			<key>allowMailSmartReplies</key>
			<false/>
			<key>allowMailSummary</key>
			<false/>
			<key>allowNotesTranscriptionSummary</key>
			<false/>
			<key>allowSafariSummary</key>
			<false/>
			<key>allowWritingTools</key>
			<false/>
		</dict>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>.GlobalPreferences</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>NSAutomaticInlinePredictionEnabled</key>
								<false/>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadDisplayName</key>
			<string>Forced settings: .GlobalPreferences</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.preferences..GlobalPreferences</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>11ED6143-5227-5A22-83F3-FA0E0C7F0794</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>com.apple.MobileAsset</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>DownloadServerBaseURLOverride-com.apple.MobileAsset.UAF.FM.CodeLM</key>
								<string>https://127.0.0.1:9/removemacai-blocked/</string>
								<key>DownloadServerBaseURLOverride-com.apple.MobileAsset.UAF.FM.GenerativeModels</key>
								<string>https://127.0.0.1:9/removemacai-blocked/</string>
								<key>DownloadServerBaseURLOverride-com.apple.MobileAsset.UAF.FM.Visual</key>
								<string>https://127.0.0.1:9/removemacai-blocked/</string>
								<key>DownloadServerBaseURLOverride-com.apple.MobileAsset.UAF.Photos.MagicCleanup</key>
								<string>https://127.0.0.1:9/removemacai-blocked/</string>
								<key>DownloadServerBaseURLOverride-com.apple.MobileAsset.UAF.Photos.SpatialPhotosRelive</key>
								<string>https://127.0.0.1:9/removemacai-blocked/</string>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadDisplayName</key>
			<string>Forced settings: com.apple.MobileAsset</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.preferences.com.apple.MobileAsset</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>6584C3B2-85A9-5F9B-9857-A0C1D1DE2CA4</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>com.apple.MobileSMS</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>messageSummarizationEnabled</key>
								<false/>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadDisplayName</key>
			<string>Forced settings: com.apple.MobileSMS</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.preferences.com.apple.MobileSMS</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>C87077F7-EBAA-5793-B96C-91F0E4E4D710</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>com.apple.Siri</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>StatusMenuVisible</key>
								<false/>
								<key>VoiceTriggerUserEnabled</key>
								<false/>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadDisplayName</key>
			<string>Forced settings: com.apple.Siri</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.preferences.com.apple.Siri</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>3C9AF865-A919-5348-9CCB-989D5F0CA545</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>com.apple.assistant.support</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>Assistant Enabled</key>
								<false/>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadDisplayName</key>
			<string>Forced settings: com.apple.assistant.support</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.preferences.com.apple.assistant.support</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>FC4630BD-3AD5-5583-B936-5105A34D76FD</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>com.apple.spatialphotosrelive</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>LocallyDisabled</key>
								<true/>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadDisplayName</key>
			<string>Forced settings: com.apple.spatialphotosrelive</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.preferences.com.apple.spatialphotosrelive</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>5F7C55B2-2E9E-5BA6-9521-35EDEA7FCC25</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>group.com.apple.mail</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>DisableAutomaticMessageSummarization</key>
								<true/>
								<key>PersonalizedSmartReplies</key>
								<false/>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadDisplayName</key>
			<string>Forced settings: group.com.apple.mail</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.preferences.group.com.apple.mail</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>EF62506A-6B8E-5931-9A89-F66C67F62D72</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>group.com.apple.usernoted</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>summarize_previews</key>
								<false/>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadDisplayName</key>
			<string>Forced settings: group.com.apple.usernoted</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.preferences.group.com.apple.usernoted</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>2D4072A1-F431-5043-B990-C1C7A2278FE1</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>io.github.omlahore.removemacai</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>installed</key>
								<true/>
								<key>kept</key>
								<string></string>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadDisplayName</key>
			<string>Forced settings: io.github.omlahore.removemacai</string>
			<key>PayloadIdentifier</key>
			<string>io.github.omlahore.removemacai.preferences.io.github.omlahore.removemacai</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>307BE890-F6C6-50A0-9E82-1BA2C055079C</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
	</array>
	<key>PayloadDescription</key>
	<string>Turns Apple Intelligence off and stops its models downloading again. Remove this profile to undo.</string>
	<key>PayloadDisplayName</key>
	<string>RemoveMacAI</string>
	<key>PayloadIdentifier</key>
	<string>io.github.omlahore.removemacai</string>
	<key>PayloadOrganization</key>
	<string>RemoveMacAI</string>
	<key>PayloadRemovalDisallowed</key>
	<false/>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>7C031166-2E85-5BC5-9EBF-EA0E58ED34B1</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

[omlahore]

That one's on purpose. kept holds whatever you passed to --keep, so it's empty when you keep nothing. status reads it back.