TCC Full Disk Access denied for Endpoint Security system extension on macOS 26, host app already granted FDA permission

I have developed an Endpoint Security (ES) system extension using Xcode 16.4. This extension is embedded inside its host application SecureGuard. The host app is signed with a Developer ID Application certificate, and I have created a dedicated ES system extension profile for SecureGuard FileGuard Extension.

The workflow works perfectly on macOS 15.3.2. However, on macOS 26, although theSecureGuard host app launches and successfully installs/activates the ES extension, the ES extension gets rejected by TCC due to missing Full Disk Access authorization. I have explicitly granted Full Disk Access permission to the host SecureGuard application in the macOS System Settings.

What I have verified so far:

1. SIP was disabled for debugging on macOS 15.3.2, while SIP remains enabled on macOS 26. The app bundle is signed with Developer ID Application and successfully notarized via Apple’s notary service; the ES extension profile is also correctly configured. I do not believe SIP is the root cause here.
2. On macOS 26, output from systemextensionsctl list shows:

com.secureguard.fileguard.extension (2026.8/7.2) Extension [activated enabled]

This confirms the system extension is successfully installed and activated, with valid code‑signing.

1. I collected system logs with this command:

log show --last 30m --predicate 'process CONTAINS "fileGuard"' --info --debug

Repeated error messages appear:

14:00:42.271778+0800 0x7d38     Error       0x0                  2246   0    com.secureguard.fileguard.extension: (libEndpointSecurity.dylib) Failed to open service: 0xe00002d8: Caller lacks TCC authorization for Full Disk Access

1. For backward‑compatibility with older Intel‑based Mac hardware, both the SecureGuard host app and its ES system extension run under Rosetta translation.

My hypothesis: when launchd spawns the ES extension process, TCC denies Full Disk Access for the extension itself, even though the parent host app already holds Full Disk Access permissions. Rosetta translation may potentially be a contributing factor.

Has anyone encountered this TCC permission divergence between host app and Endpoint Security system extension on macOS 26? Are there any extra entitlement/profile requirements I missed?