Deploying Switchboard
2026-11-03. Business deployment is under development. Do not treat this branch as a signed, published installer.
Install and identify the app
The current build requires macOS 26. The app bundle is com.payablesdesk.switchboard; its separate engine is com.payablesdesk.switchboard.engine. Deploy the release to /Applications/Switchboard.app, not a renamed copy. The engine, CLI and MCP helper are bundled with it.
A release .pkg requires a Developer ID Installer certificate in addition to the Application certificate and notarization credentials. IT should verify the package with pkgutil --check-signature and spctl --assess --type install before deploying it. A package signature and notarization are release gates; an unsigned developer build is not equivalent.
Managed preferences
The example switchboard-managed.mobileconfig contains all supported keys under com.payablesdesk.switchboard. Both app and engine read forced preferences from that explicit domain. Remove optional placeholder values before deploying; an empty LicenceFile is deliberately invalid and will not grant a trial.
| Key | Type | Plan | Meaning |
| SkipWelcome | Boolean | Team | Skip welcome. It does not grant macOS permissions. |
| LicenceFile | String | Team | Base64 of an unmodified signed team licence file. Expiry is enforced locally. |
| AIAllowed | Boolean | Business | Permit model use. False blocks AI steps and provider requests. |
| RelayAllowed | Boolean | Business | Permit the Switchboard AI relay. BYOK is separately controlled by AIAllowed. |
| AIAPIKey | String | Team | Company Anthropic key. A profile containing it is sensitive; prefer a secure per-device delivery process. |
| iCloudSyncAllowed | Boolean | Business | Permit private CloudKit library sync. |
| SharingAllowed | Boolean | Business | Permit sharing/export. Audit logs have a separate explicit export flow. |
| ShellStepsAllowed | Boolean | Business | Permit shell, AppleScript and CLI steps. This is not a general network firewall. |
| MCPAllowed | Boolean | Business | Permit MCP integration and agent-labelled runs. |
| ExtensionAllowlist | Array of strings | Business | Permitted extension identifiers. Absent or empty means unrestricted. |
| UpdateChannel | String | Team | stable, beta or none. none leaves release deployment to IT. |
| TeamLibraryURL | String | Team | Team-library folder or git source; only use after the team-library release gate passes. |
| AgentApprovalFloor | String | Business | never, phone or always: the least approval any agent run gets; a macro's own stricter choice still wins. |
| AgentExposeNewMacros | Boolean | Business | Forces whether new macros are visible to agents (including macros made with AI). |
| AgentExtensionToolsAllowed | Array of strings | Business | <extension id>/<tool id> entries: the most extension tools agents may use. |
| AuditLogDirectory | String | Business | A folder where the engine appends one JSONL line per finished run, one file a day, never deleted by Switchboard. |
For a development check, point SWITCHBOARD_MANAGED_PLIST to a property-list dictionary containing these keys. It is a fixture override, not the mobileconfig wrapper. Real macOS profiles must be installed through MDM or System Settings > Privacy & Security > Profiles; modern macOS does not support the old unattended profiles -I path.
Permissions
Accessibility, Automation, Input Monitoring and Screen Recording are distinct permissions. Grant only what your macros need. Inspect the actual signed release requirement with codesign -dr - /Applications/Switchboard.app and for the embedded engine before building a PPPC policy.
The example PPPC profile is intentionally incomplete. Replace its designated requirement with the release's actual requirement. macOS may still require the user to approve Screen Recording and other protected services; a profile is not a promise of silent consent.
Update channels
General settings defaults to Stable; users can choose Beta unless UpdateChannel is forced by MDM. stable checks /appcast.xml, beta checks /appcast-beta.xml, and none refuses new Sparkle checks and newly selected updates. IT can then deploy the next signed .pkg. A policy change does not cancel an installer already authorised before that change. Changing Beta back to Stable does not downgrade the installed version.
Release maintainers use mac/build.sh --release for Stable or mac/build.sh --release --beta. Each writes a complete signed RSS feed into mac/.build/release-dist/ alongside its DMG and PKG. Output preserves earlier items and artifacts so Standard customers can still find the newest release covered by their update date. Keep that directory between releases, or restore the published feed and artifacts into it on a new build machine. Upload the selected feed and its retained releases together. A reused build number or existing artifact version fails before packaging; increase both for a new release. Never replace a published signed download.
People and offline Macs
Buy Team by card at /buy, or request a Paddle invoice from /business. Paddle bills yearly with net 30 and an optional PO number. The owner/admin assigns people, not machine accounts.
An owner/admin downloads a signed licence file from Account > Team. Encode the entire file as base64 and deliver it as LicenceFile, or use Settings > Account > Use a licence file. Never edit its signed payload. The file ends 30 days after the paid period; renewal requires a replacement file.
For online members, removal refuses later activation and a cached online licence lasts at most 7 days after its last refresh. For offline Macs, remove the managed LicenceFile and imported local file during offboarding. SCIM cannot revoke a file on a Mac it cannot reach.
Logs and removal
Use Activity > Export audit log or switchboard trace export --format jsonl for local runs. Exports contain step inputs/outputs; store them with the same care as the library. An owner/admin exports server team events from Account.
Run bash uninstall.sh --dry-run as the affected Mac user to preview removal, then bash uninstall.sh. The script asks the signed app to unregister that user's engine login item, sends TERM only to processes at the installed app's exact executable paths, waits for them to stop, and uses sudo only to remove /Applications/Switchboard.app. Run the login-item step for each user of a shared Mac before removing the app. It refuses root execution and symlinks; MDM administrators should run the per-user part in the user's session.
The script preserves ~/Library/Application Support/Switchboard; --purge explicitly deletes that user's data. Remove only the customer's identified profile through the MDM. Keychain credentials and TCC grants need separate removal through the applicable system tools; deleting the app does not erase either. A signed-package install/uninstall pilot is still a release gate.