Seed2

2026-07-10 13:08:36 +02:00 · 2026-06-22 15:55:19 -04:00
parent 9468f879c3
commit 97a11a861f
305 changed files with 408 additions and 431 deletions
@@ -33,7 +33,7 @@ payloadkeys:
    describes. The activation only installs when the predicate evaluates to `true`
    or isn't present.
 examples:
-  title: Activation examples
+- title: Activation examples
  files:
  - tab: One configuration
    description: This activation applies one configuration.
@@ -87,6 +87,6 @@ payloadkeys:
    - `Default`: The most restrictive accessibility that still satisfies all uses of the asset by configurations that reference it.
    - `AfterFirstUnlock`: The keychain item is only available after the first unlock of the device.
 examples:
-  title: Asset example
+- title: Asset example
  files:
  - file: examples/declarative/declarations/assets/credential.acme/example1.json
@@ -74,6 +74,6 @@ payloadkeys:

      If the `Authentication` dictionary is absent, the default authentication type is MDM.
 examples:
-  title: Asset example
+- title: Asset example
  files:
  - file: examples/declarative/declarations/assets/credential.certificate/example1.json
@@ -87,6 +87,6 @@ payloadkeys:
    - `Default`: The most restrictive accessibility that still satisfies all uses of the asset by configurations that reference it.
    - `AfterFirstUnlock`: The keychain item is only available after the first unlock of the device.
 examples:
-  title: Asset example
+- title: Asset example
  files:
  - file: examples/declarative/declarations/assets/credential.identity/example1.json
@@ -87,6 +87,6 @@ payloadkeys:
    - `Default`: The most restrictive accessibility that still satisfies all uses of the asset by configurations that reference it.
    - `AfterFirstUnlock`: The keychain item is only available after the first unlock of the device.
 examples:
-  title: Asset example
+- title: Asset example
  files:
  - file: examples/declarative/declarations/assets/credential.scep/example1.json
@@ -84,6 +84,6 @@ payloadkeys:

      If the `Authentication` dictionary is absent, the default authentication type is MDM.
 examples:
-  title: Asset example
+- title: Asset example
  files:
  - file: examples/declarative/declarations/assets/credential.userpassword/example1.json
@@ -63,7 +63,7 @@ payloadkeys:

    If `true`, `KeyType` needs to be `ECSECPrimeRandom` and `KeySize` needs to be `256` or `384`.

-    On macOS, this is a required key. Set the value to `false`.
+    Set this key to `false` on Mac devices that don't have Apple silicon or a T2 chip.
 - key: Subject
  title: Subject
  type: <array>
@@ -145,13 +145,12 @@ payloadkeys:
  type: <boolean>
  presence: optional
  default: false
-  content: If `true`, the device provides attestations that describe the device and
-    the generated key to the ACME server. The server can use the attestations as strong
-    evidence that the key is bound to the device, and that the device has properties
-    listed in the attestation. The server can use that as part of a trust score to
-    decide whether to issue the requested certificate. When `Attest` is `true`, set
-    `HardwareBound` to `true`. On macOS, set this key, if present, to `false`. The
-    hardware requirements for attestation are described below.
+  content: |-
+    If `true`, the device provides attestations that describe the device and the generated key to the ACME server. The server can use the attestations as strong evidence that the key is bound to the device, and that the device has properties listed in the attestation. The server can use that as part of a trust score to decide whether to issue the requested certificate.
+
+    When `Attest` is `true`, set `HardwareBound` to `true`.
+
+    The hardware requirements for attestation are described below.
 notes:
 - title: ''
  content: |-
@@ -170,6 +169,6 @@ notes:
    | Ignored            | A10x Fusion and earlier              | Intel          | A10x Fusion and earlier | S3 and earlier | none       |
    | Supported          | A11 Bionic and later<br>All M series | Apple silicon  | A12 Bionic and later    | S4 and later   | All        |
 examples:
-  title: Credential example
+- title: Credential example
  files:
  - file: examples/declarative/declarations/assets/credentials/acme/example1.json
@@ -25,6 +25,6 @@ payloadkeys:
  presence: required
  content: 'The PKCS #12 identity data.'
 examples:
-  title: Credential example
+- title: Credential example
  files:
  - file: examples/declarative/declarations/assets/credentials/identity/example1.json
@@ -127,6 +127,6 @@ payloadkeys:
    presence: optional
    content: The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`.
 examples:
-  title: Credential example
+- title: Credential example
  files:
  - file: examples/declarative/declarations/assets/credentials/scep/example1.json
@@ -25,6 +25,6 @@ payloadkeys:
  presence: optional
  content: The password for this credential.
 examples:
-  title: Credential example
+- title: Credential example
  files:
  - file: examples/declarative/declarations/assets/credentials/usernameandpassword/example1.json
@@ -68,6 +68,6 @@ payloadkeys:

      If the `Authentication` dictionary is absent, the default authentication type is MDM.
 examples:
-  title: Asset example
+- title: Asset example
  files:
  - file: examples/declarative/declarations/assets/data/example1.json
@@ -25,6 +25,6 @@ payloadkeys:
  presence: optional
  content: The email address of the user.
 examples:
-  title: Asset example
+- title: Asset example
  files:
  - file: examples/declarative/declarations/assets/useridentity/example1.json
@@ -72,7 +72,7 @@ related-status-items:
  - account.list.caldav
  note: Each configuration will have a corresponding status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up a CalDAV account for calendars.
    file: examples/declarative/declarations/configurations/account.caldav/example1.json
@@ -72,7 +72,7 @@ related-status-items:
  - account.list.carddav
  note: Each configuration will have a corresponding status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up a CardDAV account for contacts.
    file: examples/declarative/declarations/configurations/account.carddav/example1.json
@@ -352,7 +352,7 @@ related-status-items:
  - account.list.exchange
  note: Each configuration will have a corresponding status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up a Microsoft Exchange account.
    file: examples/declarative/declarations/configurations/account.exchange/example1.json
@@ -59,7 +59,7 @@ related-status-items:
  - account.list.google
  note: Each configuration will have a corresponding status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up a Google account.
    file: examples/declarative/declarations/configurations/account.google/example1.json
@@ -107,7 +107,7 @@ related-status-items:
  - account.list.ldap
  note: Each configuration will have a corresponding status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up an LDAP directory account.
    file: examples/declarative/declarations/configurations/account.ldap/example1.json
@@ -236,7 +236,7 @@ related-status-items:
  note: Each configuration will have a corresponding status item for incoming and
    outgoing accounts.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up an IMAP email account with SMTP outgoing
      mail.
@@ -63,7 +63,7 @@ related-status-items:
  - account.list.subscribed-calendar
  note: Each configuration will have a corresponding status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration subscribes to a calendar feed.
    file: examples/declarative/declarations/configurations/account.subscribed-calendar/example1.json
@@ -510,7 +510,7 @@ related-status-items:
  - app.managed.list
  note: Each configuration has a corresponding status item.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: App Store
    description: This configuration installs an App Store app with `Required` install
@@ -349,7 +349,7 @@ notes:

    Only AppKit-based apps on macOS support this feature.
 examples:
-  title: Configuration examples
+- title: App privacy examples
  files:
  - tab: Allow various permission defaults for several apps in iOS
    description: This configuration sets various privacy permission defaults for several
@@ -82,7 +82,7 @@ notes:
    - Pair and use audio accessories - the device records the pairing and synchronizes it to their iCloud account.
    - Use the audio accessory AirPods Sharing feature.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration enables temporary pairing and sets an unpairing
      time of 6 pm.
@@ -316,7 +316,7 @@ payloadkeys:
    system uses to verify the security of the status reporting https connection. Required
    when `ManagementSecurityConfig` is set to `signedByCACert` or `specificServerCert`.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Basic caching
    description: This configuration enables content caching for both personal and
@@ -57,7 +57,7 @@ payloadkeys:
      - `ReadOnly`: The system can only mount read-only network storage. Note that network storage that's read-write won't be mounted read-only.
      - `Disallowed`: The system can't mount any network storage.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration prevents the use of external and network storage
      devices.
@@ -558,7 +558,7 @@ payloadkeys:
      content: If `true`, the system detects the password during web authentication
        and synchronizes it to the local account password for the user.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Credential
    description: This configuration sets up a Credential-type SSO extension that handles
@@ -59,7 +59,7 @@ payloadkeys:
    title: Allowed workspace ID
    type: <string>
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: External Intelligence Restrictions
    description: This configuration restricts external intelligence integrations.
@@ -197,7 +197,7 @@ payloadkeys:
  combinetype: boolean-or
  content: If `true`, forces On-Device Only Translation.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Intelligence Restrictions
    description: This configuration restricts several Apple Intelligence features.
@@ -100,7 +100,7 @@ payloadkeys:
  combinetype: boolean-and
  content: If `false`, disables text replacement.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Keyboard Restrictions
    description: This configuration restricts keyboard features.
@@ -90,7 +90,7 @@ notes:

    If a user enrollment triggers this configuration: in macOS the system silently ignores any MDMv1 payloads in macOS where the User Enrollment Mode setting is `forbidden`; in iOS, tvOS, watchOS and visionOS, the system rejects the entire profile if any MDMv1 payload has its User Enrollment Mode setting set to `forbidden`.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: URL
    description: Downloads the profile from a URL on the MDM server.
@@ -118,7 +118,7 @@ notes:
    2. Any attempt to install, update, or remove the profile using MDM commands fails (using the usual identifier and UUID matching rules). This holds true while the DDM profile is active.
    3. Updates to the DDM configuration result in the system reapplying the profile which updates the system state with any new or changed settings.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: URL
    description: Downloads the profile from a URL on the MDM server.
@@ -64,7 +64,7 @@ payloadkeys:
      presence: required
      content: The name of the status item to send to subscribers.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration subscribes to a set of device status items.
    file: examples/declarative/declarations/configurations/management.status-subscriptions/example1.json
@@ -83,7 +83,7 @@ payloadkeys:
  content: The status the system reports back when the device implements the configuration.
    Use this to override the normal `success` result.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration tests the management framework with a custom status
      result.
@@ -131,7 +131,7 @@ payloadkeys:
    combinetype: boolean-and
    content: Controls whether Math Notes is allowed in other apps such as Notes.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration prevents the use of scientific and programmer
      modes in calculator app.
@@ -74,7 +74,7 @@ notes:

    The device reports Migration Assistant progress using the `StatusMigrationAssistantState` status item, and provides a report when migration completes using the `StatusMigrationAssistantReport` status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration provides settings for a Mac to Mac migration.
    file: examples/declarative/declarations/configurations/migration-assistant.settings/example1.json
@@ -77,7 +77,7 @@ payloadkeys:
    processes DNS lookups traffic for managed apps with the same `DNSProxyUUID` in
    their app attributes. This key is required for user enrollment.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up a DNS proxy using a Network Extension
      app.
@@ -248,7 +248,7 @@ notes:
    * For device enrollments, the settings are limited to only managed networks.
    * For local installs, the settings apply to all networks.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up encrypted DNS using DNS-over-HTTPS.
    file: examples/declarative/declarations/configurations/network.dns-settings/example1.json
@@ -178,7 +178,7 @@ payloadkeys:
  content: If `true`, the device allows the relay to failover to the default system
    DNS resolver.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Single relay
    description: This configuration routes traffic to two domains through a single
@@ -230,70 +230,6 @@ payloadkeys:
            In iOS, tvOS, and visionOS, the identifier is a bundle ID, for example, "com.example.app".

            In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID", "Bundle-ID (Team-ID)", or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Team-ID" is the team identifier from the provider's code signature. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app" for the bundle ID format, "com.example.app (ABCD1234)" for the team ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.
-      - key: NetworkRouting
-        title: Network routing details
-        supportedOS:
-          tvOS:
-            introduced: n/a
-        type: <dictionary>
-        presence: optional
-        content: Specifies details about how the VPN routes different types of network
-          traffic.
-        subkeys:
-        - key: EnforceRoutes
-          title: Enforce routes
-          type: <boolean>
-          presence: optional
-          default: false
-          content: |-
-            If `true`, all the VPN's non-default routes take precedence over any locally defined routes.
-
-            If `IncludeAllNetworks` is `true`, the system ignores the value of `EnforceRoutes`.
-        - key: IncludeAllNetworks
-          title: Include all networks
-          type: <boolean>
-          presence: optional
-          default: false
-          content: |-
-            If `true`, routes all traffic through the VPN, with some exclusions. Several of the exclusions can be controlled with the `ExcludeLocalNetworks`, `ExcludeCellularServices`, `ExcludeAPNs` and `ExcludeDeviceCommunication` properties. The following traffic is always excluded from the tunnel:
-
-            - Traffic necessary for connecting and maintaining the device's network connection, such as DHCP.
-            - Traffic necessary for connecting to captive networks.
-            - Certain cellular services traffic that's not routable over the internet and is instead directly routed to the cellular network. See the ExcludeCellularServices property for more details.
-            - Network communication with a companion device such as a watchOS device.
-        - key: ExcludeLocalNetworks
-          title: Exclude local networks
-          type: <boolean>
-          presence: optional
-          content: If `true` and `IncludeAllNetworks` is `true`, routes all local
-            network traffic outside the VPN.
-        - key: ExcludeCellularServices
-          title: Exclude cellular services
-          type: <boolean>
-          presence: optional
-          default: true
-          content: If `true` and `IncludeAllNetworks` is `true`, then the system excludes
-            internet-routable network traffic for cellular services (VoLTE, Wi-Fi
-            Calling, IMS, MMS, Visual Voicemail, etc.) from the tunnel. Note that
-            some cellular carriers route cellular services traffic directly to the
-            carrier network, bypassing the internet. The device always excludes such
-            cellular services traffic from the tunnel.
-        - key: ExcludeAPNs
-          title: Exclude APNs
-          type: <boolean>
-          presence: optional
-          default: true
-          content: If `true` and `IncludeAllNetworks` is `true`, then the system excludes
-            the network traffic for the Apple Push Notification service (APNs) from
-            the tunnel.
-        - key: ExcludeDeviceCommunication
-          title: Exclude device communication
-          type: <boolean>
-          presence: optional
-          default: true
-          content: If set to `true` and `IncludeAllNetworks` is set to `true`, the
-            device excludes network traffic used for communicating with devices connected
-            via USB or Wi-Fi from the tunnel.
      - key: Idle
        title: Disconnect on idle settings.
        type: <dictionary>
@@ -968,7 +904,7 @@ payloadkeys:
      content: The identifier of an asset declaration that contains the credentials
        (user name and password) to authenticate with the proxy server.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up an always-on IKEv2 VPN for both Cellular
      and Wi-Fi interfaces using certificate authentication.
@@ -842,7 +842,7 @@ payloadkeys:
      content: The identifier of an asset declaration that contains the credentials
        (user name and password) to authenticate with the proxy server.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Shared secret
    description: This configuration sets up an IKEv2 VPN using a shared-secret credential
@@ -169,16 +169,6 @@ payloadkeys:
    presence: optional
    default: false
    content: If `true`, enables VPN On Demand.
-  - key: DisableUserOverride
-    title: Prevent users from toggling VPN on demand
-    supportedOS:
-      macOS:
-        introduced: n/a
-    type: <boolean>
-    presence: optional
-    default: false
-    content: If `true`, the device disables the Connect On Demand toggle in Settings
-      for this configuration.
  - key: Rules
    title: On demand rules
    type: <array>
@@ -497,7 +487,7 @@ payloadkeys:
      content: The identifier of an asset declaration that contains the credentials
        (user name and password) to authenticate with the proxy server.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Shared secret
    description: This configuration sets up an IPSec VPN using a shared secret and
@@ -578,7 +578,7 @@ payloadkeys:
      content: The identifier of an asset declaration that contains the credentials
        (user name and password) to authenticate with the proxy server.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Password
    description: This configuration sets up a VPN plugin using username and password
@@ -67,7 +67,7 @@ notes:
    fonts, documents, and other items. Apps that a package installs aren't automatically
    managed; you can manage them using the `AppManaged` declaration.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration installs a required package.
    file: examples/declarative/declarations/configurations/package/example1.json
@@ -258,7 +258,7 @@ notes:
    - `MinimumLength`: always set to `6`
    - `MaximumInactivityInMinutes`: if this key is present its value is ignored, but the `never` option is removed in the Settings UI.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Complex
    description: This configuration applies a complex passcode policy.
@@ -105,7 +105,7 @@ payloadkeys:
              or a nested folder of bookmarks.
            subkeys: *id001
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: 'This configuration applies a set of managed bookmarks: two bookmarks
      and one bookmarks folder, which contains two more bookmarks.'
@@ -146,7 +146,7 @@ notes:
    "DeniedDomains": ["*example.com"]
    ```
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Disallow all
    description: This configuration disables all Safari extensions.
@@ -267,7 +267,7 @@ notes:

    The user can change the website privacy permission settings in Safari settings if they choose.
 examples:
-  title: Configuration examples
+- title: Settings and restrictions examples
  files:
  - tab: Start page
    description: This configuration sets the Safari start page to show a specific
@@ -276,11 +276,13 @@ examples:
  - tab: Restrictions
    description: This configuration restricts several Safari features.
    file: examples/declarative/declarations/configurations/safari.settings/example2.json
-  - tab: Website privacy (1)
+- title: Website privacy examples
+  files:
+  - tab: One website
    description: This configuration sets the camera permission default in Safari for
      one specific website.
    file: examples/declarative/declarations/configurations/safari.settings/example3.json
-  - tab: Website privacy (2)
+  - tab: One website and its children
    description: This configuration sets the camera and microphone permission defaults
      in Safari for a specific website and its child websites.
    file: examples/declarative/declarations/configurations/safari.settings/example4.json
@@ -48,7 +48,7 @@ related-status-items:
  note: Any unresolved connection groups in the configuration will appear in the corresponding
    status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration defines a group of screen-sharing connections.
    file: examples/declarative/declarations/configurations/screensharing.connection.group/example1.json
@@ -70,7 +70,7 @@ payloadkeys:
    for this connection to authenticate with the screen-sharing server. Set the corresponding
    asset type to `com.apple.asset.credential.userpassword`.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up a screen-sharing connection to a remote
      Mac.
@@ -61,7 +61,7 @@ payloadkeys:
  content: If `true`, the system prevents clients from establishing high-performance
    connections to the host.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration manages screen-sharing host settings and restrictions.
    file: examples/declarative/declarations/configurations/screensharing.host.settings/example1.json
@@ -64,7 +64,7 @@ related-status-items:
  - security.certificate.list
  note: Each configuration will have a corresponding status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration installs a certificate on the device.
    file: examples/declarative/declarations/configurations/security.certificate/example1.json
@@ -95,7 +95,7 @@ related-status-items:
  - security.certificate.list
  note: Each configuration will have a corresponding status item.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration installs a certificate identity on the device.
    file: examples/declarative/declarations/configurations/security.identity/example1.json
@@ -57,7 +57,7 @@ payloadkeys:
    title: Relying party
    type: <string>
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration enables enterprise passkey attestation for a relying
      party.
@@ -24,13 +24,13 @@ payloadkeys:
  type: <string>
  presence: required
  content: The unique identifier of the set of background tasks managed with this
-    configuration. This should be a reverse DNS style identifier. The system uses
+    configuration. This should be a reverse DNS style identifier. The device uses
    this identifier to differentiate between tasks in different configurations.
 - key: TaskDescription
  title: Task description
  type: <string>
  presence: optional
-  content: A description of the set of background tasks managed by this configuration.
+  content: A description of the set of background tasks this configuration manages.
 - key: ExecutableAssetReference
  title: Executable asset reference
  type: <string>
@@ -42,14 +42,19 @@ payloadkeys:
  content: |-
    Specifies the identifier of an asset declaration containing a reference to the files to be used for the background task configuration. The corresponding asset must be of type `com.apple.asset.data`.

-    The referenced data must be a zip archive of an entire directory, that will be expanded and stored in a well known location for the background task. The asset's "ContentType" and "Hash-SHA-256" keys in the "Reference" key are required.
+    The referenced data must be a zip archive of an entire directory that the device expands and stores in a well known location for the background task. The asset's "ContentType" and "Hash-SHA-256" keys in the "Reference" key are required.

-    This file should contain background task executables, scripts, and configuration files, but not the `launchd` configuration files.
+    This zip archive should contain background task executables, scripts, and configuration files, but not the `launchd` configuration files.
+
+    The device stores the expanded zip archive in the tamper-proof `/var/db/ManagedConfigurationFiles/BackgroundTaskServices/Services/<TaskType>` directory, where `<TaskType>` is the value of the `TaskType` key in the configuration.
 - key: LaunchdConfigurations
  title: Launchd configurations
  type: <array>
  presence: optional
-  content: An array of `launchd` configuration files used to run the background tasks.
+  content: |-
+    An array of `launchd` configuration files used to run the background tasks.
+
+    The device stores the configuration files in the tamper-proof `/var/db/ManagedConfigurationFiles/BackgroundTaskServices/LaunchDaemons` or `/var/db/ManagedConfigurationFiles/BackgroundTaskServices/LaunchAgents` directories, based on the `Context` value for each item.
  subkeys:
  - key: launchd-item
    title: Launchd item
@@ -80,7 +85,7 @@ payloadkeys:
      rangelist:
      - daemon
      - agent
-      content: Indicates whether the system applies the launchd configuration file
+      content: Indicates whether the device applies the launchd configuration file
        to the system daemon or system agent domain.
 related-status-items:
 - status-items:
@@ -99,9 +104,9 @@ notes:
    If both `ExecutableAssetReference` and `LaunchdConfigurations` are present, and the device changes just the executable data, it kills and restarts any running tasks associated with the launchd configurations.

    > Note:
-    > If an executable is an app, the system can't manage the app as it can only manage apps installed in `/Applications`. Also, the system can't use system extensions in the app as it only loads them from apps installed in `/Applications`.
+    > If an executable is an app, the device can't manage the app as it can only manage apps installed in `/Applications`. Also, the device can't use system extensions in the app as it only loads them from apps installed in `/Applications`.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up a background task using a launchd daemon.
    file: examples/declarative/declarations/configurations/services.background-tasks/example1.json
@@ -88,7 +88,7 @@ notes:
    > Important:
    > The system reserves the `com.apple` prefix for built-in services.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration deploys configuration files for a system service.
    file: examples/declarative/declarations/configurations/services.configuration-files/example1.json
@@ -49,6 +49,26 @@ payloadkeys:
  default: true
  combinetype: boolean-and
  content: If `false`, disables Siri.
+- key: AllowSiriAI
+  title: Allow Siri AI
+  supportedOS:
+    iOS:
+      introduced: '27.0'
+      sharedipad:
+        allowed-scopes: []
+    macOS:
+      introduced: '27.0'
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: '27.0'
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  combinetype: boolean-and
+  content: If `false`, disables the Siri AI specific features of Siri.
 - key: AllowUserGeneratedContent
  title: Allow user generated content
  supportedOS:
@@ -91,8 +111,26 @@ payloadkeys:
  default: false
  combinetype: boolean-or
  content: If `true`, forces Siri profanity filter.
+- key: ForceReduceSensitiveContent
+  title: Force reduce sensitive content
+  supportedOS:
+    iOS:
+      introduced: '27.0'
+    macOS:
+      introduced: '27.0'
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: n/a
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: false
+  combinetype: boolean-or
+  content: If `true`, forces Siri to reduce sensitive content.
 examples:
-  title: Configuration examples
+- title: Configuration examples
  files:
  - tab: Siri Restrictions
    description: This configuration restricts Siri features.
@@ -86,7 +86,7 @@ notes:

    If the device isn't running at the target date-time, the system enforces the software update 1 hour after restarting, or when the device meets all required conditions, such as minimum battery level.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration enforces a software update to a specific OS version
      and build at a specified time.
@@ -376,7 +376,7 @@ related-status-items:
  - softwareupdate.beta-enrollment
  - softwareupdate.pending-version
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration manages software update behavior and deferral
      settings.
@@ -48,7 +48,7 @@ payloadkeys:
    content: Specifies the identifier of an asset declaration containing the anchor
      certificate to be used.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration enrolls an Apple Watch using a profile URL.
    file: examples/declarative/declarations/configurations/watch.enrollment/example1.json
@@ -273,7 +273,7 @@ payloadkeys:
          the scheduled time and the actual runtime of the task, due to the scheduling
          mechanism on the system.
 examples:
-  title: Configuration example
+- title: Configuration example
  files:
  - description: This configuration sets up a web content filter using a Network Extension
      plugin bundle.
@@ -43,6 +43,6 @@ payloadkeys:
    content: A token that verifies the identity of the organization when using this
      service.
 examples:
-  title: Management declaration example
+- title: Management declaration example
  files:
  - file: examples/declarative/declarations/management/organization-info/example1.json
@@ -20,6 +20,6 @@ payloadkeys:
  presence: optional
  content: Each entry represents a property key/value.
 examples:
-  title: Management declaration example
+- title: Management declaration example
  files:
  - file: examples/declarative/declarations/management/properties/example1.json
@@ -33,6 +33,6 @@ payloadkeys:
    presence: optional
    content: Additional keys may be present.
 examples:
-  title: Management declaration example
+- title: Management declaration example
  files:
  - file: examples/declarative/declarations/management/server-capabilities/example1.json
@@ -99,7 +99,7 @@ payloadkeys:
      presence: optional
      content: If `true`, the Reminders app is displaying reminders for the account.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated account
    description: Reports a new or updated account.
@@ -88,7 +88,7 @@ payloadkeys:
      presence: optional
      content: The user name for the account.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated account
    description: Reports a new or updated account.
@@ -118,7 +118,7 @@ payloadkeys:
      content: A Boolean value that indicates whether the Reminders app displays reminders
        for this account.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated account
    description: Reports a new or updated account.
@@ -102,7 +102,7 @@ payloadkeys:
      content: A Boolean value that indicates whether the Notes app displays notes
        for this account.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated account
    description: Reports a new or updated account.
@@ -95,7 +95,7 @@ payloadkeys:
      content: A Boolean value that indicates whether the account is enabled for use
        with the Contacts app.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated account
    description: Reports a new or updated account.
@@ -100,7 +100,7 @@ payloadkeys:
      content: A Boolean value that indicates whether the Notes app displays notes
        for this account.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated account
    description: Reports a new or updated account.
@@ -88,7 +88,7 @@ payloadkeys:
      presence: optional
      content: The user name for the account.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated account
    description: Reports a new or updated account.
@@ -89,7 +89,7 @@ payloadkeys:
      content: A Boolean value that indicates whether the Calendar app displays this
        subscribed calendar.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated account
    description: Reports a new or updated account.
@@ -269,7 +269,7 @@ reasons:
    valuetype: timestamp
    description: The RFC 3339 timestamp of the last update failure.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated app
    description: Reports a new or updated app.
@@ -95,6 +95,6 @@ payloadkeys:
    content: The amount of disk space, in bytes, available to the Content Cache for
      personal iCloud content.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/content-cache.info/example1.json
@@ -66,7 +66,7 @@ payloadkeys:
      presence: required
      content: The version number of the parent Content Cache software.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated parent
    description: Reports a new or updated parent.
@@ -72,7 +72,7 @@ payloadkeys:
      presence: required
      content: The version number of the peer Content Cache software.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated peer
    description: Reports a new or updated peer.
@@ -1,4 +1,4 @@
-title: Status Content Cache Service
+title: Status Content Cache Status
 description: The status item that reports the status of the Content Cache service.
 payload:
  statusitemtype: content-cache.status
@@ -154,6 +154,6 @@ payloadkeys:
    presence: required
    content: The version number of the Content Cache software.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/content-cache.status/example1.json
@@ -53,6 +53,6 @@ payloadkeys:
  presence: required
  content: The device's serial number.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.identifier.serial-number/example1.json
@@ -55,6 +55,6 @@ payloadkeys:
    This value is only available on user channels whose organization matches that
    of the device channel.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.identifier.udid/example1.json
@@ -56,6 +56,6 @@ payloadkeys:
  presence: required
  content: The hardware family of the device, such as `Mac`, `iPhone`, or `iPad`.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.model.family/example1.json
@@ -60,6 +60,6 @@ payloadkeys:
    is the version, and the second part is a variant, such as `MacBookPro15,1` or
    `iPhone13,2`.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.model.identifier/example1.json
@@ -57,6 +57,6 @@ payloadkeys:
  content: The device's marketing name, such as `iPhone 12`. This value may not always
    be available.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.model.marketing-name/example1.json
@@ -56,6 +56,6 @@ payloadkeys:
  presence: required
  content: The device's model number.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.model.number/example1.json
@@ -56,6 +56,6 @@ payloadkeys:
  presence: required
  content: The operating system's build version on the device, such as `18F132`.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.operating-system.build-version/example1.json
@@ -56,6 +56,6 @@ payloadkeys:
  presence: required
  content: The operating system family in use on the device, such as `macOS` or `iOS`.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.operating-system.family/example1.json
@@ -57,6 +57,6 @@ payloadkeys:
  presence: required
  content: The operating system's marketing name in use on the device, such as `Catalina`.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.operating-system.marketing-name/example1.json
@@ -58,6 +58,6 @@ payloadkeys:
  content: The operating system's build and Background Security Improvement versions
    in use on the device, for example, `20A123a` or `20B27c`.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.operating-system.supplemental.build-version/example1.json
@@ -58,6 +58,6 @@ payloadkeys:
  content: The operating system's Background Security Improvement version in use on
    the device, for example, `a`.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.operating-system.supplemental.extra-version/example1.json
@@ -56,6 +56,6 @@ payloadkeys:
  presence: required
  content: The operating system's version in use on the device, such as `15.0`.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.operating-system.version/example1.json
@@ -57,6 +57,6 @@ notes:
    - [iPad devices](https://support.apple.com/117759)
    - [macOS devices](https://support.apple.com/108376)
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.power.battery-health/example1.json
@@ -123,6 +123,6 @@ payloadkeys:
      - `ok`: The component is operating normally.
      - `error`: The component has a detected error or failure.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/device.system.health/example1.json
@@ -25,6 +25,6 @@ payloadkeys:
  presence: required
  content: A Boolean value that specifies the File Vault enabled status on the device.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/diskmanagement.filevault.enabled/example1.json
@@ -37,6 +37,6 @@ payloadkeys:
  content: The current enhanced log collection session AppleCare token. The device
    returns an empty string if there's no session status to report.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/enhanced-logging.applecare-token/example1.json
@@ -1,4 +1,4 @@
-title: Status Enhanced Logging
+title: Status Enhanced Logging Status
 description: The status item that reports the device's enhanced log collection session
  status.
 payload:
@@ -59,6 +59,6 @@ payloadkeys:
    - `cancelled` - The device management service cancelled the enhanced log collection session.
    - `declined` - The user declined the enhanced log collection session.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/enhanced-logging.status/example1.json
@@ -38,6 +38,6 @@ payloadkeys:
    reports for the last session status change. The device returns an empty string
    if there's no session status to report.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/enhanced-logging.timestamp/example1.json
@@ -143,6 +143,6 @@ payloadkeys:
        type: <string>
        content: Supported status item.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/management.client-capabilities/example1.json
@@ -169,6 +169,6 @@ notes:
 - title: ''
  content: The name of the declaration status item is `management.declarations`.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/management.declarations/example1.json
@@ -116,7 +116,7 @@ payloadkeys:
      - failed
      content: The status of the app that `ManagedApplicationListCommand` reports.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - tab: New or updated app
    description: Reports a new or updated app.
@@ -62,6 +62,6 @@ payloadkeys:
    - `device`: Device enrollment
    - `user`: User enrollment
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/mdm.enrollment-type/example1.json
@@ -48,6 +48,6 @@ payloadkeys:
  presence: required
  content: If `true`, the device is awaiting configuration from the MDM server.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/mdm.is-awaiting-configuration/example1.json
@@ -38,6 +38,6 @@ payloadkeys:
  content: If `true`, the device is using the return to service with app preservation
    mode.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/mdm.is-return-to-service/example1.json
@@ -30,6 +30,6 @@ payloadkeys:
  presence: required
  content: If `true`, the device is a Shared iPad.
 examples:
-  title: Status item example
+- title: Status item example
  files:
  - file: data/docc-examples/remotemanagementmodel/status/mdm.is-shared-ipad/example1.json
--- a/Show More
+++ b/Show More