Broadly yes, but parent-controlled suspension is not required. The executable must remain unchanged; it is not necessarily third-party. We need a supported way to reject an fsync on an open native APFS file if a deadline expires or authorization is lost after an allow check but before synchronization starts. Can any public API enforce rejection across that gap, and at what exact event? No SPI, SIP changes, or cancellation of work already started.

Thank you, Quinn — this was extremely helpful. The suspended posix_spawn + pre-IPC audit-token binding directly addresses the process-occurrence problem I was trying to solve. I also appreciate the compatibility warning. I’ll look closely at es_new_descendants_client as a potentially better long-term path. Thanks again!

Thanks. We launch the target ourselves with posix_spawn and control its code, so IPC can wait until prebinding is complete. Is there a supported public API to obtain its audit_token_t before IPC, later get the audit token for the XPC/Mach message, and compare them as the same post-exec process occurrence across exec/restart/PID reuse?

Thanks. We can use the simplest controlled case: we launch the target ourselves with posix_spawn, control its code, and can prevent it from sending the IPC request until prebinding is complete. Is there a supported public API path to obtain the target’s audit_token_t before IPC, later obtain the audit token for the individual XPC/Mach message, and compare them as the same post-exec process occurrence across exec/restart/PID reuse?