iOS 27 turns mobile apps into callable AI capabilities

At a glance

What this is: iOS 27 moves mobile apps toward callable capabilities that Siri AI can discover and invoke inside agentic workflows.

Why it matters: IAM, AppSec, and platform teams need to reassess authentication, confirmation, and consent boundaries when AI can initiate actions across apps without a traditional user journey.

By the numbers:

• Our recent 2026 Mobile App Risk Management Survey found most enterprise mobile apps already use AI capabilities.

👉 Read NowSecure's analysis of iOS 27 app intents and Siri AI workflows

Context

iOS 27 changes the mobile application security model by allowing Siri AI and Apple Intelligence to discover app functionality, invoke actions, and orchestrate workflows across applications. In practice, that means the mobile app is no longer only a user interface protected by local controls. For identity and access teams, the key issue is whether AI-driven invocation respects the same authentication, confirmation, and consent boundaries that human-driven interaction has traditionally required.

The governance gap is not whether an app has APIs, but whether its exposed intents and schemas create new paths to sensitive actions when an AI system chooses the next step. That matters for mobile IAM, AppSec, and fraud controls because the user may not manually traverse the app before an action executes. In expansion terms, this is a broader access-governance problem with a genuine identity angle: AI is acting as a delegated initiator of application actions.

Key questions

Q: What should security teams do when mobile apps expose actions to AI assistants?

A: Security teams should classify exposed intents as privileged capabilities, then decide which ones require stronger authentication, explicit confirmation, or complete exclusion from AI discovery. The right control is not only API hardening but workflow governance, because the assistant can select and chain actions outside the user’s normal path.

Q: Why do agentic mobile workflows change access control assumptions?

A: They change the assumption that a user must manually navigate the app before sensitive actions occur. When an AI assistant can gather context and invoke intents across apps, access control must govern the delegated path to action, not just the user interface. That is an identity and authorization problem as much as a UX problem.

Q: What do teams get wrong about testing AI-enabled mobile apps?

A: Many teams still test screens, APIs, and permissions separately. That misses the actual risk path, which is the complete AI-driven workflow from prompt to context gathering to intent execution. If the workflow is not tested end to end, sensitive actions can remain reachable through paths that never appear in conventional mobile test cases.

Q: Should organisations treat AI-discoverable app functions as privileged access?

A: Yes. If an action can be discovered and invoked by Siri AI or a similar assistant, it should be governed like a privileged operation, with explicit review of data exposure, confirmation requirements, and fraud impact. The key question is not whether the action exists, but whether delegated discovery should be allowed.

Technical breakdown

App intents as callable application capabilities

App Intents are structured action definitions that let the operating system discover and invoke application functions. They resemble an internal action interface, not a public API for other apps. In iOS 27, the difference is that Siri AI can reason over those intents, select the one that best matches a request, and chain multiple actions across apps. That turns application functionality into machine-readable capabilities that can be composed at runtime. The security consequence is that design decisions about intent exposure now influence whether sensitive actions can be reached through AI-mediated paths rather than only through the app UI.

Practical implication: inventory every exposed intent and classify which ones should require explicit confirmation or stronger authentication.

How app schemas change discovery and context sharing

App schemas give Apple Intelligence a standardized vocabulary for understanding entities and actions inside an app. That helps Siri determine what the app contains, what it can do, and what context it can use across a workflow. The risk is that the schema can widen discoverability beyond what developers originally considered user-visible. If a sensitive entity is discoverable, an AI assistant may surface or combine it in ways that were never exercised in traditional UI testing. This is a control-plane shift as much as a feature change: schema design becomes part of the application’s trust boundary.

Practical implication: review schema-level data exposure and treat discoverability as a security decision, not just a product choice.

Authentication and confirmation in agentic workflows

Agentic workflows can move from a user request to a completed action without the user manually navigating the application. That creates a new authorization moment: the AI may decide which action to use, but the app still determines which operations need confirmation or stronger checks before execution. If authentication policies are not consistently tied to intent risk, a low-friction workflow can become a weak-control pathway to sensitive operations. Traditional mobile testing often validates screens and APIs separately, but agentic flows require end-to-end evaluation across prompt, context, model reasoning, and final action execution.

Practical implication: test the full AI-driven workflow and verify that high-risk actions still trigger appropriate confirmation and step-up controls.

NHI Mgmt Group analysis

Callable capability design is now an access-control problem. Once Siri AI can discover and invoke app functions, the control question shifts from interface hardening to delegated action governance. App Intents are effectively machine-readable privilege surfaces, and the risk is not just misuse but overexposure of sensitive actions to AI-mediated selection. For IAM and AppSec practitioners, the practical conclusion is to classify intents the same way they classify privileged operations.

App schemas create a discovery trust gap. Standardized schemas help AI understand app content, but they also make more data and actions discoverable to the system than many teams expect. That makes schema design part of security architecture, not just product engineering. The named concept here is agent-discoverable privilege: functionality that becomes reachable because an AI assistant can see it, not because a user intentionally navigated to it. Teams should treat discoverability as a governed capability boundary.

Mobile security testing must evolve from screen coverage to workflow coverage. Traditional AppSec checks whether an app behaves correctly when a person taps through the interface. Agentic workflows break that assumption because the AI can assemble context from multiple sources and invoke actions without the same user path. OWASP MASVS still matters, but it is no longer sufficient on its own when runtime orchestration can change the path to action. The practitioner conclusion is to test decision paths, not just interfaces.

Identity governance now extends into delegated AI initiation. Even when the app retains final authority over risky actions, the AI assistant is acting as the trigger and selector inside the workflow. That creates a governance gap between user intent, model selection, and application execution. In broader identity terms, the system is not just authenticating a person, it is mediating an AI intermediary. Teams should therefore document where AI is allowed to initiate privileged app behavior and where it is not.

The mobile platform shift is industry-wide, not Apple-specific. The article’s comparison to Android AppFunctions matters because it shows this is an architectural direction rather than a single-vendor feature. That means control design should focus on intent exposure, confirmation policy, and workflow testing across platforms. Practitioners should not wait for a single operating system rollout to define the control model; they should build portable governance now.

What this signals

Agent-discoverable privilege will become a practical governance issue as mobile platforms make more functions visible to embedded AI systems. That means product teams, AppSec, and identity governance leaders will need a shared decision record for which actions can be discovered, selected, and chained by assistants, and which actions remain human-only.

Mobile programmes should expect the control discussion to shift from app hardening to delegated action review. The important questions will be where confirmation is mandatory, which data can flow into AI context, and how to evidence that an AI-driven path to action has been tested before release.

For identity teams, the real signal is that AI-mediated mobile interactions are becoming another access layer, not just another feature. Treating those interactions as governed privilege will matter more than trying to bolt AI awareness onto legacy mobile test processes.

For practitioners

• Inventory exposed app intents Map every App Intent and schema in production and pre-production mobile apps, then classify each one by sensitivity, authentication requirement, and whether Siri AI should be allowed to discover it.
• Require step-up controls for high-risk actions Bind high-risk intents to confirmation prompts, step-up authentication, or explicit user verification before execution, especially for payments, data retrieval, and account changes.
• Test end-to-end AI workflows Build test cases that start with a natural-language request and follow the full Siri AI path through context gathering, intent selection, and action execution.
• Review data movement across AI pathways Track which application data is surfaced to models, what context is shared across apps, and whether sensitive records leave the intended trust boundary during agentic workflows.
• Document platform-specific governance decisions Define which capabilities may be exposed to Apple Intelligence and comparable Android workflows, then record the approval criteria in your mobile access governance model.

Key takeaways

• iOS 27 turns app intents into AI-discoverable capabilities, which expands the mobile attack surface beyond the visible interface.
• The security issue is delegated access, because Siri AI can select and chain actions that users do not manually traverse.
• AppSec and IAM teams need to inventory intents, enforce confirmation on high-risk actions, and test end-to-end AI workflows before release.

Key terms

• App Intents: Apple’s framework for exposing app actions to system-level assistants such as Siri. These intents can read data, modify content or trigger external actions, so they must be treated as authorization-controlled execution points rather than simple UI shortcuts. Their risk depends on the side effects they can reach.
• Agent-discoverable privilege: A capability becomes agent-discoverable privilege when an AI system can see, select, and invoke it as part of a workflow. The risk is that access is granted through discovery and orchestration, not through the traditional user path. That changes how teams should classify and test sensitive app actions.
• App schema: A standardised description of app entities and actions that helps an assistant understand what the app can do. Schemas improve interoperability, but they also expand what the assistant can discover about the app’s data and workflows. Security teams should treat schema design as part of the trust boundary.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.

What's in the full article

NowSecure's full article covers the operational detail this post intentionally leaves for the source:

• Practical guidance on inventorying App Intents and mapping them to authentication requirements before launch.
• Testing considerations for AI-driven workflows that span prompts, context sources, and final action execution.
• Implementation detail on schema design, confirmation policies, and mobile workflow safeguards.
• Cross-platform implications for Android AppFunctions and similar assistant-driven capabilities.

👉 The full NowSecure article covers the App Intents model, workflow testing implications, and mobile security steps for production readiness.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It is a strong fit for practitioners who need to connect identity controls to emerging AI-driven workflows.