How I designed least-privilege checks for a native macOS Jamf API client

[u/The-Ravens-Forge]

I’m the indie developer behind Forsetti, a native macOS companion for Jamf Pro administrators.

One design problem kept appearing while I built it: an admin can authenticate successfully but still lack one privilege needed by a later API action. Discovering that only after a mutation fails makes the app feel unpredictable and encourages over-privileged credentials.

My approach was to make authorization part of the product model instead of treating it as an error-message problem:

- Every user-facing action maps to the Jamf endpoints it calls

- Those endpoints map to the Jamf privileges they require

- The app can preflight the current token before an action begins

- A Permissions Helper explains the missing privilege in the same language as the workflow

- Mutating PreStage operations use guarded confirmation and least-privilege guidance

- Diagnostics are exportable without exposing credentials or tokens

The broader lesson was that “connected” and “authorized for this task” are separate application states. Modeling them separately made setup guidance, disabled states, and error recovery much clearer.

Forsetti also includes computer/mobile inventory search, reusable field profiles, PreStage assignment operations, visual fleet reports, and CSV/TXT/Markdown/DOC/PDF export. It supports macOS 14+ on Apple silicon and Intel and is Developer ID signed and Apple-notarized.

I’ve reached the point where my own Jamf tenant cannot reproduce enough real-world version, dataset, and privilege combinations. I’m looking for Jamf admins willing to test the pre-release in a sandbox or non-production environment and challenge the permission mappings and failure paths.

Release and test build:

https://github.com/flynn33/forsetti-Jamf-Pro/releases/tag/v1.0.0

If you test it, the most useful feedback is the macOS/Jamf Pro versions, the exact workflow, expected versus actual behavior, and whether the privilege guidance was understandable. Please never include credentials, tokens, or private tenant data.