Endpoint Security framework

Endpoint Security is the framework Apple provides for security products that need to see — and in some cases decide — what is happening on a Mac. It replaced the kernel extension approach that Apple deprecated, and it is the only supported way to get authorization control at this level.

For AI containment it is the load-bearing mechanism, because it is what turns a policy decision into an actual denial.

NOTIFY versus AUTH

The distinction matters more than any other detail here.

NOTIFY events tell you something happened. They are asynchronous, they are for observation and logging, and by the time you receive one the operation has already occurred.

AUTH events ask permission. The operating system suspends the operation and waits for your extension to return an allow or deny verdict. AUTH_OPEN for file access, AUTH_EXEC for process execution.

A product built only on NOTIFY events can honestly say it detected something. It cannot honestly say it blocked it. This is precisely the distinction BitShout preserves by labelling policy denials and OS denials differently — see Trust.

The deadline

AUTH events come with a deadline. If your extension does not respond in time, macOS applies a default and, depending on the event, may kill the client. This is a hard engineering constraint with a direct security consequence: an authorization callback cannot wait for a human.

It is why BitShout resolves the callback on policy and handles human approval as a separate asynchronous flow that produces a grant for subsequent attempts, rather than blocking your Mac while a dialog is open.

The entitlement is the hard part

com.apple.developer.endpoint-security.client is a restricted entitlement. You cannot grant it to yourself. Apple must approve it for your team, for a specific use case, and the process is neither fast nor guaranteed.

There is a second gate: even with the entitlement, the extension must be signed, packaged as a system extension, installed, and approved by the user on the machine. Any of those can fail independently.

BitShout’s Endpoint Security adapter is built, its policy path is proven, and the suite passes on real hardware in our lab. Production runtime denial depends on that entitlement, which is submitted and in review with Apple. The site says so on every page where the capability is described rather than in a disclaimer at the bottom — because security claims must be testable.