You just updated to Sonoma, and now half your apps are throwing 'You do not have permission to open the application' at you like you're some kind of intruder. Annoying, right? Let's fix it.
The quick fix: strip the quarantine flag
Open Terminal (Applications > Utilities > Terminal) and run this, replacing the path with the actual path to your app. If you don't know it, drag the app from Finder into Terminal after typing the first part.
sudo xattr -rd com.apple.quarantine /Applications/YourApp.appHit Enter, type your admin password (it won't show while typing), and try opening the app again. Nine times out of ten, that's it. Fixed.
If that doesn't work, check ownership
Sometimes the updater mangles the app bundle's ownership. Run this:
sudo chown -R $(whoami):staff /Applications/YourApp.appThen try launching again. This happens a lot if you restored from a Time Machine backup made on an older macOS.
Still no luck? Reset the app's launch services entry
Launch Services is the database macOS uses to decide what can open what. Occasionally it gets confused after a major OS update. Rebuild it for that app:
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f /Applications/YourApp.appGive it a few seconds, then open the app.
Why does this happen after a Sonoma update?
The culprit here is almost always the quarantine attribute. When you download an app from the internet, macOS tags it with com.apple.quarantine. That flag tells Gatekeeper to check the app's signature before letting it run. Normally that check happens once, the app runs, and you never think about it again.
Major macOS updates — Sonoma included — sometimes reset or re-evaluate these flags. Apple tightened Gatekeeper in Sonoma, and apps that were previously grandfathered in suddenly aren't. Older apps, apps from small developers, or anything not notarized properly will trip over the stricter checks. Stripping the quarantine flag tells macOS 'yeah, I know where this came from, it's fine.'
Skip the GUI 'Allow Anyway' button in System Settings > Privacy & Security. It only shows up half the time and does the same thing the xattr command does, just slower.
Less common variations
The app opens but crashes immediately
That's a different animal. Usually a code signing issue. Check with:
codesign -vvv --deep --strict /Applications/YourApp.appIf it reports 'resource envelope is obsolete' or 'code object is not signed at all,' the app needs to be reinstalled from a fresh download. Don't waste time trying to resign it unless you built it yourself.
Permission denied on a specific folder, not the app
If the app launches but can't read your Documents or Desktop, Sonoma's new privacy prompts are the issue. Go to System Settings > Privacy & Security > Files and Folders. Find the app in the list and toggle access on. If the app isn't listed, launch it once, trigger the error, then come back — it'll show up.
App is on an external drive
Sonoma is picky about external volumes. If the drive is formatted exFAT or NTFS, the app may not have proper execution permissions. Move it to /Applications on your boot drive. If you must keep it external, format the drive as APFS.
Multiple user accounts
If you fixed it for your account but another user still gets the error, the fix didn't stick system-wide. Run the xattr command with sudo and make sure you're targeting the app bundle itself, not a symlink or alias. Aliases won't work with xattr.
Preventing this next time
Before you update macOS, quit all third-party apps. Don't just close the windows — actually quit them from the menu bar. Apps running during an OS update can have their bundles modified in ways that break permissions.
Also, keep a list of apps you've installed from outside the Mac App Store. After a major update, run the xattr command on those proactively. It takes two minutes and saves you the headache later.
And if you're restoring from a backup after a failed update, restore to the same macOS version you backed up from. Restoring a Ventura backup onto a Sonoma install is a reliable way to break permissions across the board.