Thank you Eskimo! After I modified the code sign scripts with removing the "deep" options, the issues no happen on macOS13.

Anything Update here? Same issue happened with my notarized pkg, which containing a host app with system extension(Both Endpoint Security and Content Fliter) When the host app load, it will report error message: removing service since it exited with consistent failure - OS_REASON_CODESIGNING | When validating /Applications/XXXX.app/Contents/MacOS/XXXService: Hardened Runtime relaxation entitlements disallowed on System Extensions

We got same issue: Apple tell us we have been able to use the Endpoint Security entitlements. But when we login as admin account, and try to create the mac development profiles which contain the Endpoint Security entitlements, we found that only "Network Extension Dev" showed in the listbox in additional Entitlements, where can we choose the Endpoint Security entitlements?

We cann't load kext any more in macOS11 when SIP is on.