This is a pre-implementation question about supported direct Keychain service access, based on documentation and SDK-declaration review. No device/Simulator result, runtime failure, compiled sample or verified signing configuration is being reported. Assumed configurations An embedded, app-specific, non-UI ExtensionFoundation extension, restricted to its containing app's extension point. No unrestricted or third-party extension scope is assumed. A: the extension point requires EnhancedSecurity(true). B: the point definition omits EnhancedSecurity. This is not a claim that B is unsandboxed or equivalent to every configuration explicitly declaring EnhancedSecurity(false). Generic-password items, with valid signed membership in the destination Keychain access group assumed for the question only. If that assumption cannot hold for A or B, please identify the unsupported prerequisite. No real identifiers or profiles are supplied. Version scope The API question concerns iOS 26.0 and later only where the relevant symbols/configurations are supported. In the installed iPhoneOS 27.0 SDK declarations inspected, AppExtensionPoint, EnhancedSecurity and UserInterface have iOS 26.0 availability; some binding conveniences have iOS 26.2 availability. Those are declaration observations, not evidence of Keychain authorization or behavior on any OS release. No runtime comparison or final deployment target is selected. Please specify any finer minimum OS/SDK requirement or version-dependent difference; do not infer older-iOS support from the framework name alone. Question For A and B separately, is each of SecItemCopyMatching, SecItemAdd, SecItemUpdate and SecItemDelete supported directly from the extension process for those items, without forwarding the operation to the containing app? Please distinguish the four operations and, for any supported or conditional case, identify: The public sandbox/service rule and required entitlements, separately from access-group membership. Applicable OS/SDK versions and any device-versus-Simulator or development-versus-distribution limits. Lock state, item accessibility, user-interaction or other prerequisites that change the answer. If a case is unsupported or unspecified, stating that and citing the applicable public documentation would resolve that part of the question. API availability or absence of the EnhancedSecurity requirement alone is not being treated as permission to access the service. This asks for the direct API/service boundary only. Relevant public references https://developer.apple.com/documentation/extensionfoundation/adding-support-for-app-extensions-to-your-app https://developer.apple.com/documentation/extensionfoundation/appextensionpoint/enhancedsecurity https://developer.apple.com/documentation/security/sharing-access-to-keychain-items-among-a-collection-of-apps