When the Drata Agent is deployed via administrative or Mobile Device Management (MDM) tools, application files and directories may inherit restricted system-level permissions. If the active local user lacks Read and Write (RW) access, the agent cannot write logs, update local state files, or replace binary packages during updates.

The user running the Drata Agent must have Read and Write (RW) access to the application bundle/installation directory and its active data files:

(Refer to internal documentation: Agent File Locations for custom deployment paths.)

Auto-update failures frequently occur when permissions on the top-level application wrapper differ from the internal package contents.

Run the following commands in Terminal to compare wrapper and inner bundle permissions:

Bash

Expected Output: Both the application directory and the Contents folder should display read, write, and execute permissions (drwxr-xr-x or drwxrwxr-x) assigned to the active user or their primary administrative group.

If permissions are misaligned or read-only, cascade ownership and write permissions across the entire package bundle.

To apply these permissions through all nested subdirectories and binaries:

Note for MDM Administrators: If your MDM solution or endpoint manager runs periodic enforcement policies, package reinstalls or compliance scripts may reset these permissions. Ensure your deployment script explicitly provisions the /Applications/Drata Agent.app folder with the target user as owner.

Ensure the active Windows user account has full Modify rights to both the executable directory and the working data files.