Managed Configuration

Operational policy

These keys let IT admins govern update channels and logging policy.

Transcript-history retention

These keys bound the in-memory Recent Dictations history (the cleaned-text list in the Parleq window). Both are integers; either or both can be set, and whichever limit is hit first drops entries. With no policy, history is unbounded until the app quits — there is no on-disk transcript retention surface either way.

Learn from corrections

These keys govern the opt-in “Learn from your corrections” feature (off by default). When enabled, Parleq keeps short correction snippets in memory only (never written to disk) and occasionally asks the user’s already-configured cleanup model to suggest custom-dictionary improvements. No new network destination is introduced — analysis uses the same cleanup model the user already has configured. IT can pin this feature off entirely or bound the in-session correction ring by entry count and retention window. The semantics are the same as for the transcriptHistory* keys: either Int key set to 0 disables the ring entirely.

Known limitation — customDictionary entry content

The customDictionary feature lets users define term/context pairs that are injected verbatim into the LLM cleanup prompt to bias transcription of jargon, proper nouns, and project-specific vocabulary. MDM can suppress the entire feature by setting customDictionaryEnabled=false, but cannot constrain the content of individual entries when the feature is enabled. A user with a permissive policy can therefore add arbitrary text to the dictionary, which Parleq will pass to the LLM provider as part of its prompt for every cleanup call.

In compliance-sensitive deployments where prompt content must be controlled, set customDictionaryEnabled=false. There is no “allow only these entries” mode — the feature is binary at the MDM level.

Sample .mobileconfig

The snippet below shows the feature-toggle keys set to enforce a privacy-focused posture: reference windows are allowed but image-mode and file references are disabled, auto-update is managed centrally, and the live-pricing fetch is turned off. The full sample profile in the repo also exercises the provider/model lockdown and auth-mode restriction keys.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key>
      <string>com.apple.ManagedClient.preferences</string>
      <key>PayloadIdentifier</key>
      <string>com.example.parleq-policy.prefs</string>
      <key>PayloadUUID</key>
      <string>REPLACE-WITH-A-NEW-UUID</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>PayloadDisplayName</key>
      <string>Parleq managed preferences</string>

      <!-- mdmclient reads PayloadContent → bundle ID → Forced
           → [mcx_preference_settings] and materializes the keys
           into /Library/Managed Preferences/com.parleq.app.plist so
           CFPreferencesAppValueIsForced returns true for each. -->
      <key>PayloadContent</key>
      <dict>
        <key>com.parleq.app</key>
        <dict>
          <key>Forced</key>
          <array>
            <dict>
              <key>mcx_preference_settings</key>
              <dict>
                <!-- Allow reference windows -->
                <key>referenceWindowsEnabled</key>
                <true/>

                <!-- Allow clipboard references -->
                <key>clipboardReferenceEnabled</key>
                <true/>

                <!-- Disable image-mode (no screenshots to LLM) -->
                <key>imageReferenceEnabled</key>
                <false/>

                <!-- Disable file picker + drag-drop -->
                <key>fileReferenceEnabled</key>
                <false/>

                <!-- Allow custom dictionary -->
                <key>customDictionaryEnabled</key>
                <true/>

                <!-- Restrict model picker to curated list -->
                <key>customModelEntryEnabled</key>
                <false/>

                <!-- Manage auto-update centrally -->
                <key>autoUpdateEnabled</key>
                <false/>
              </dict>
            </dict>
          </array>
        </dict>
      </dict>
    </dict>
  </array>

  <key>PayloadDisplayName</key>
  <string>Parleq policy</string>
  <key>PayloadIdentifier</key>
  <string>com.example.parleq-policy</string>
  <key>PayloadUUID</key>
  <string>REPLACE-WITH-A-NEW-UUID</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

Replace both REPLACE-WITH-A-NEW-UUID placeholders with unique UUIDs (e.g. from uuidgen in Terminal). Also replace the com.example identifiers with your own organization’s reverse-DNS prefix.

How to deploy

1. 1.

   Author your profile.

   Start from the sample snippet above. Set the keys you want to manage; omit keys you want users to control themselves. Any key absent from the profile is not managed — Parleq uses the user’s stored preference or the built-in default.

2. 2.

   Upload to your MDM.

   In Jamf Pro: Computers → Configuration Profiles → New → Custom Schema / Application & Custom Settings payload. In Kandji: Library → Custom Profile → upload the .mobileconfig. In Mosyle: Apple Configurator → General → Custom Configuration Profile. All other MDMs that speak macOS MDM protocol accept the same .mobileconfig format.

3. 3.

   Scope and push.

   Assign the profile to a device group, smart group, or individual machines. The MDM pushes the profile on the next MDM check-in (typically within a few minutes). Settings take effect on Parleq’s next launch after check-in.

Verification

To confirm a key took effect on a managed Mac, open Terminal and run:

defaults read com.parleq.app referenceWindowsEnabled
defaults read com.parleq.app imageReferenceEnabled
defaults read com.parleq.app autoUpdateEnabled

Each command prints 0 (false) or 1 (true), or The domain/default pair of (com.parleq.app, <key>) does not exist when the key is not managed.

To confirm the key came from managed preferences (not just a user-domain write), check the managed-preferences plist directly:

sudo defaults read /Library/Managed\ Preferences/com.parleq.app

For verification without Terminal access, open Parleq Settings → Privacy & Features and click View managed configuration…. The Compliance Audit dialog lists every managed-eligible key with its current effective value and source (Managed / User / Default), and includes a Copy snapshot button that places the full state as JSON on the clipboard so an IT admin can verify policy uptake without screen-sharing.

Local testing without an MDM

To verify a managed config payload locally without enrolling the Mac in an MDM, you can write to /Library/Managed Preferences/ directly with root. Two gotchas worth knowing:

1. The directory may not exist on an unmanaged Mac. /Library/Managed Preferences/ is created the first time an MDM enrolls the device. On a personal Mac you’ll need to create it yourself.
2. cfprefsd caches managed-preferences lookups. A Parleq restart alone won’t pick up the new plist; you also need to invalidate the daemon cache.

Working recipe:

# 1. Create the directory if it doesn't exist
sudo mkdir -p "/Library/Managed Preferences"

# 2. Write the managed plist directly. Do NOT use `defaults write` here —
#    its path-domain parser falls back to ~/Library/Preferences/ when the
#    path contains multiple dots (com.parleq.app is three dots), so the
#    file silently lands in the user domain instead of Managed.
sudo tee "/Library/Managed Preferences/com.parleq.app.plist" > /dev/null <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>referenceWindowsEnabled</key>
    <false/>
</dict>
</plist>
EOF

# 3. Verify the file landed correctly
sudo plutil -p "/Library/Managed Preferences/com.parleq.app.plist"

# 4. Force the prefs daemon to invalidate its cache
sudo killall cfprefsd

# 5. Restart Parleq — the toggle should now be locked OFF and disabled

Parleq logs a one-line summary at startup listing the MDM-managed keys it detected; tail ~/.parleq/app.log to confirm your override was picked up.

To remove the override:

sudo rm "/Library/Managed Preferences/com.parleq.app.plist"
sudo killall cfprefsd
# restart Parleq — toggle is user-controllable again