Hi Omar, Thank you very much! Disabling AMFI has helped me to run extension under Parallels Desktop.

Hmm, it looks like my daemon needs Full Disk Access, because it runs successfully, if I allow it Full Disk Access in System Preferences. The question is why the app, which is a wrapper around endpoint service daemon, requires that access? And how does the system know it needs it?

Hi Quinn! I’m not sure I understand your question. When you say “app” are you referring to your daemon that’s been placed in an app-like package? Or do you have some other app in play here? It is the first one. I'm referring the daemon placed in the app-like package. I'm wondering, how the macOS knows my daemon needs such the access? Can it be because I use some DiskArbitration API calls to get information about the disk when handling the ES events? Thanks, Aleksandr

Found it, it was my fault, of course – I had a very large static arrays.