Hi, I’m developing a native macOS music app intended for the Mac App Store. We already support Audio Units and are investigating VST3 instrument and effect hosting on Apple Silicon. Users would install plugins themselves, typically in: /Library/Audio/Plug-Ins/VST3 ~/Library/Audio/Plug-Ins/VST3 The app would load these third-party plugin bundles using public APIs, such as CFBundleLoadExecutableAndReturnError. Plugins may be signed by developers with different Team IDs. Our app would not download or install them. Is there a supported way to load and execute these bundles while the hosting process remains sandboxed throughout? If so, which APIs and entitlements should we use? Specifically, I’m trying to distinguish permission to read a plugin bundle from permission to load its executable code. Would user selected folder access and security scoped bookmarks cover the sandbox access requirements, or is another mechanism needed? I understand that com.apple.security.cs.disable-library-validation addresses loading code signed by other developers, but does not itself grant sandbox file access. We cannot rely on an Audio Unit compatibility exception that disables the host’s sandbox. App Review Guideline 3.1.1 (https://developer.apple.com/app-store/review/guidelines/#in-app-purchase) explicitly allows Mac App Store apps to host plugins enabled outside the App Store. I’m looking for the supported technical approach under App Sandbox, rather than preapproval for our app. We’re checking this before implementation, so we don’t yet have a failing reproducer. Any relevant documentation, sample code or existing discussion would be appreciated. Thanks, Ben