# xcode/entitlements

> Checks each entitlement against `xcode.allowed_entitlements`, when the settings hold that list.

Checks each entitlement against `xcode.allowed_entitlements`, when the settings hold that list.

Part of the [`xcode`](/reference/configurations/xcode/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once per scope. gspot runs this check itself. It skips until you set `xcode.allowed_entitlements`.

## Why

Each entitlement grants the app a system capability, so a new one needs its own review.

## What to do

Remove the entitlement, or add it to xcode.allowed\_entitlements.

## Example

An `.entitlements` key missing from `xcode.allowed_entitlements` reports a finding. Remove it, or add it to that list.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore xcode/entitlements --paths "<glob>" --reason "<why>"
```