Setup → Create installer (macOS .pkg). Extract
AdaAgentSetup-<version>.pkgandAdaAgentSetup.adacfg into the same folder, then
double-click the package. macOS asks for an administrator password.
Users installing themselves, or MDM
Terminal
The macOS client (Terminal) command (section 12.1.3)
Administrators and scripted installs
The package’s post-install step reads .adacfg, downloads
macos-client-setup.sh from the server, and runs it with
--with-agent. Its log is
/var/log/ada-install.log.
12.3.2 What is installed where
Item
Location / label
App bundle
/Library/Application Support/AdaClassification/Ada Agent.app
(binary Contents/MacOS/ada-agent; menu bar helper in
Contents/Library/LoginItems/AdaMenuBar.app)
Root daemon
com.ada.classification.daemon —
/Library/LaunchDaemons/com.ada.classification.daemon.plist
(ada-agent daemon, root). Handles policy sync, heartbeat,
commands, audit queue, token and signing key, and uninstall.
~/Library/Services/Classify with ADA.workflow (named
ADA ile Sınıflandır when the region is Turkish)
Launcher app
~/Applications/Ada Pending Files.app — opens the
pending list when the menu bar icon is hidden (for example behind the
notch)
Office web add-ins
Manifests sideloaded into
~/Library/Containers/com.microsoft.{Word,Excel,Powerpoint}/Data/Documents/wef/.
A permanent copy is kept and re-placed if Office resets its container.
Outlook is not sideloaded (see section 12.5).
Signing identity
“Ada Local Signing”, created once per machine. The bundle is
re-signed with it at every install, so macOS privacy grants survive
upgrades.
All four services run with launchd KeepAlive. The agent
and the helper watch each other, and the daemon restores a service that
is booted out. A restore is audited as tamper_detected.
Binaries, plists and machine state are root-owned, so a standard user
cannot remove them.
12.3.3 Permissions to grant
Permission
Needed for
Without it
How
Full Disk Access for Ada
Agent
File monitoring of the home folder (Desktop, Documents, Downloads
are privacy-protected)
Nothing is scanned. The agent still heartbeats,
syncs policy and executes commands. After 20 s its log says “File
watching has NOT started after 20s — it is most likely waiting for macOS
permission.” ada-agent doctor shows
Full Disk Access [FAIL].
System Settings → Privacy & Security → Full Disk Access → enable
Ada Agent. For a fleet, push a PPPC profile from MDM.
Accessibility for the menu bar helper
The screen watermark in label mode (it reads which document
each window shows)
Label-triggered watermark is not drawn. Always mode needs
no permission.
The helper asks once per build. Switch it on under Privacy &
Security → Accessibility. On unsigned builds the user must switch it on
again after every update.
Finder extension approval
The Classify with ADA Quick Action
The right-click entry is missing
System Settings → General → Login Items & Extensions → Finder →
enable the action
Keychain prompt for “Ada Local Signing”
Re-signing at install
Prompts repeat
Answer Always Allow once
Desktop/Documents and Local Network prompts
First access
—
Asked once per machine. Grants survive upgrades thanks to the
durable signing identity.
Screen Recording, Notifications
Not needed
—
Ada draws its own pop-ups and never captures the screen
12.3.4 Procedure — single Mac
Launch Word, Excel and PowerPoint once beforehand. Each app’s
container exists only after its first launch; otherwise setup reports
“container not found” for that app. Setup can also queue the manifest,
and the agent places it later.
Run the Terminal command or the package.
If setup prints
ACTION NEEDED: these Office apps are OPEN, quit them with
⌘Q and reopen.
Grant Full Disk Access and approve the Quick Action (section
12.3.3).
Check status:
"/Library/Application Support/AdaClassification/Ada Agent.app/Contents/MacOS/ada-agent" status.
For a full check, use ada-agent doctor.
