I can confirm that <key>com.apple.security.temporary-exception.files.home-relative-path.read-only</key>` works. But ideally I would want to use explicit permissions. I tried <key>FSActivateOptionSyntax</key> <dict> <key>shortOptions</key> <string>m:d:</string> <key>pathOptions</key> <dict> <key>m</key> <string>Path</string> <key>d</key> <string>Directory</string> </dict> </dict> as you suggested, it does not work. options.url(forOption: "m"), options.url(forOption: "d"), returns nulls.

Are you looking in loadResource or activateVolume:? These options are passed to activateVolume: I'm calling options.url(forOption: "m") in activateVolume. I can see -m and -d options there, but they are relative. Could you please send example of FSActivateOptionSyntax config, which works on your side?

sending minimal code https://gist.github.com/goloveychuk/ce4707dd9192b4ac5947979aea70b55f

Including traces from running similar fuse program, but in lima vm. Cache is disabled. strace output