Thank you, Quinn. I've read Validating Signature Of XPC Process and the linked Outgoing XPC message goes through to untrusted Peer discussion. I understand the distinction between authenticating the sender of a received message and authenticating the actual recipient before an outgoing protected message becomes accessible. My remaining question concerns the latter guarantee. For a dedicated anonymous listener, a transferred xpc_endpoint_t, and xpc_connection_create_from_endpoint on macOS 27.0.1, is there a supported public mechanism that binds protected delivery to the authenticated receiver process occurrence and preserves that confinement despite endpoint forwarding, concurrent connections, process replacement, or queued messages? I'm not asking how to validate a received message's sender. I need to establish the destination and continuing confinement of an outgoing protected message before releasing its contents. If the public C XPC API does not provide that guarantee, could you confirm that limitation? That would help us determine whether this security boundary requires a different transport architecture. Thank you for your guidance.