Found it, it was my fault, of course – I had a very large static arrays.

Hi Quinn! I’m not sure I understand your question. When you say “app” are you referring to your daemon that’s been placed in an app-like package? Or do you have some other app in play here? It is the first one. I'm referring the daemon placed in the app-like package. I'm wondering, how the macOS knows my daemon needs such the access? Can it be because I use some DiskArbitration API calls to get information about the disk when handling the ES events? Thanks, Aleksandr

Hmm, it looks like my daemon needs Full Disk Access, because it runs successfully, if I allow it Full Disk Access in System Preferences. The question is why the app, which is a wrapper around endpoint service daemon, requires that access? And how does the system know it needs it?

Hi Omar, Thank you very much! Disabling AMFI has helped me to run extension under Parallels Desktop.