there are a few mentioned in this thread!

ours after modifications is: { "class" => "rule" "comment" => "Used by to evaluate ad hoc rules." "created" => 780002118.985772 "k-of-n" => 1 "modified" => 785095658.311386 "rule" => [ 0 => "com..AdHoc" 1 => "com..original.com.apple.ServiceManagement.daemons.modify" ] "version" => 0 }

Nope, we haven't. Our situation (simplified) looks like this: restart machine, we are using a script to tell us which application is currently active when an app opens, we are inserting into 'com.apple.ServiceManagement.daemons.modify' (the rights will be removed when the app closes) this app has the focus & remains open within 3-5 mins, the application SecurityAgent with path '/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle' takes the focus

No, we haven't. Our case scenario (simplified) is this: restart the machine, we are using a script to tell us which application is active when an app is open, insert into 'com.apple.ServiceManagement.daemons.modify' (this will be removed when the app closes) the app has the focus of the screen within 3-5 mins "/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent" takes the focus