EndpointSecurity is the sanctioned interface for security products to observe and authorize security-relevant events — process execution, file access, signals, mounts — replacing the deprecated kauth and MAC-based kernel approaches. Requires the com.apple.developer.endpoint-security.client entitlement.