macOS permission denied even as admin -- SIP and TCC

Cannot modify system files, access Desktop/Documents programmatically, or run certain commands even with sudo. Operation not permitted despite being admin.

macOS has two protection systems: (1) SIP (System Integrity Protection): protects /System, /usr (except /usr/local), and system processes. Cannot be disabled at runtime -- requires booting to Recovery Mode. Most dev work should not need to touch SIP-protected paths. (2) TCC (Transparency Consent Control): controls access to Desktop, Documents, Downloads, camera, microphone. Grant permissions in System Settings > Privacy & Security. For CLI tools: grant Full Disk Access to Terminal.app or iTerm2.

macOS restricts access even for root to prevent malware from modifying system files or accessing user data without consent.