Additional info: It shows "Could not connect to authorization daemon: The operation couldn’t be completed. The calling process does not have an application identifier. Make sure it is properly configured.." in debugger when clicking on "Continue".

The parent process is a launchd agent, running as logged in user. Basically my UI app launches this service, which is a launchd agent, which starts a macOS VM app inside (posix_spawn), then the macOS VM app has the problem. Everything runs inside sandbox. Just repeating, if I launch this macOS VM independently, it launches. Problem comes only if I launch it under a parent. The macOS VM app does not work if I start as child of my UI app too (sandboxed).

Actually, the service is started dynamically using QProcess::startDetached, not as a launch agent or launch daemon. Apologies for the confusion earlier — I initially misunderstood the setup (this wasn’t written by me, so my analysis was off). I see that this service process runs as a child of launchd, and it appears under system/subdomains when I run launchctl print system. Because of that, I can’t access its LimitLoadToSessionType. Would starting the service as a launch agent help resolve this issue? I also tried launching the macOS VM as a child of my GUI application (which itself is a launch agent with LimitLoadToSessionType set to "Aqua"), but that also failed to start the VM process.

QProcess::startDetached is from qt, when checked, it uses the double fork method to detach child process (GUI process forks child1, child1 forks child2, then child1 quits - so the child2 becomes child of launchd). Then it starts service using 'execv'. Now this service runs detached, as a child of launchd, and I'm trying to start the macOS VM process under this.