Guided Access for Mac: Four Ways to Lock a Mac to One App, and What Each One Misses

On an iPhone or iPad, Guided Access does one simple, useful thing: it pins the device to a single app and ignores every tap outside it. Hand a toddler a video, leave a tablet on a reception desk, let a student take a quiz, and nothing else on the device is reachable until you unlock it. People go looking for the same switch on a Mac, and there isn't one. macOS has no Guided Access. What it has instead is a handful of partial answers, each built for a different situation. This post walks through them and is honest about which gap each one leaves.

The short version

Option 1: MDM single-app mode (the real kiosk)

The closest thing macOS has to Guided Access is single-app mode delivered through mobile device management. A supervised Mac can be restricted to one app by an MDM profile, with everything else, down to the menu bar and keyboard shortcuts, locked out. It is how museums, retail displays and testing labs run Macs as appliances.

The catch is in the word supervised. The Mac has to be enrolled in an MDM, which usually means a company or school that owns the device and a tool such as Apple Configurator or an enterprise management platform to set it up. For a personal MacBook you want to hand to a friend for ten minutes, this is a sledgehammer, and the configuration is not something you turn on and off between meetings.

Option 2: browser kiosk flags

If the "one app" is really one web page, a dashboard, a slideshow, a form, Chrome can be launched with a kiosk flag that opens a URL full-screen with no tabs, address bar or window controls. From a terminal:

open -na "Google Chrome" --args --kiosk https://example.com/dashboard

This looks locked, and for a trusting room it is often enough. It is not a lock. The keyboard still works, so ⌘Q quits Chrome, ⌘Tab reaches every other app, and Spotlight is one keystroke away. Anyone who knows a Mac is out of your kiosk in two seconds.

Option 3: Screen Time

Screen Time on macOS can limit how long certain apps can be used and block some content, and with a passcode it survives a child closing the settings window. What it cannot do is pin the Mac to one app while you are away. It is a rules engine for a shared family Mac, not a lock for a single session.

Option 4: a visible-apps lock (what VibeLock does)

The situation most people are actually in is smaller than a kiosk: you want to leave your own Mac with one thing on screen, a video for a kid, a build log, a running Claude Code session, a demo loop on a meeting-room TV, and be certain nobody can touch anything until you are back. That is the gap VibeLock was built for, and it approaches it from the opposite direction to a kiosk: instead of granting one app, it locks everything and lets you choose what stays visible.

How it maps onto the Guided Access idea:

• Choose the allowed apps. From the menu bar, tick the apps that may stay on screen under "Visible While Locked". Terminals (Terminal, iTerm2, Warp, Ghostty, kitty, Alacritty, WezTerm), the Claude desktop app, ChatGPT/Codex and VS Code are pre-allowed; add a video player or a browser window for other jobs.
• Visible means watch-only. The app stays on screen so you, or the room, can follow it, but keystrokes, clicks and scrolls aimed at it are blocked while locked. Everything you did not allow is hidden and the desktop is covered.
• Optionally, make one app usable. A second list, "Accessible While Locked", lets a chosen app accept input while the rest stays sealed. That is the Guided Access case proper: a child can tap the video player, a colleague can approve an agent prompt, and nothing else responds. The list is empty by default and watch-only is the safer setting, because an accessible terminal is shell access for whoever is at the keyboard. Even for accessible apps, ⌘Q stays blocked so nobody can quit what you left running, and Spotlight stays blocked.
• The screen stays on. Unlike the macOS lock screen, the display does not sleep and the allowed apps keep rendering. Our guide to keeping a video playing while locked goes into the details.
• Unlock is authenticated. Touch any key and unlock with Touch ID, or type your Mac login password into the shield. Everything returns exactly as you left it.

Setup is a two-minute job: install, grant Accessibility access once (the permission input blocking requires; VibeLock needs no network, account or files), tick your visible apps, click Lock. It runs on macOS 13 Ventura or later and costs $10 once.

Where VibeLock is not the answer

Honesty about scope matters more with a security tool than with most software. VibeLock is a lock for a Mac you own and are coming back to. It is not a managed kiosk: it does not survive a reboot into a locked state the way an MDM profile does, it does not stop someone with your login password, and it is not designed for a device left unattended in public for days. For those jobs, go back to option 1. If you need a hard guarantee that nobody can read what is on screen, close the lid; a visible-apps lock is for the opposite case, where being visible is the point.

Picking the right one

• Company-owned Macs in public, locked down permanently: MDM single-app mode.
• A trusted room, one web page, no real adversary: a browser kiosk flag is fine.
• A shared family Mac that needs time limits: Screen Time.
• Your own Mac, something you want visible or playing, you are stepping away and want input dead and other apps hidden until you return: VibeLock. This is also the setup for leaving an AI agent running while you are away, which is where most of our users started.

Guided Access on the Mac may arrive one day. Until it does, knowing which of the four tools matches your situation saves the two seconds it takes someone to press ⌘Q on your "kiosk".