Under the hood
The macOS sandbox policy generator now groups rules to keep generated policies smaller.
The macOS sandbox profile generator now groups deny and pin file-write rules that share a parent directory into combined regex patterns, splitting file-write-unlink/file-write-create handling from generic file-write* rules, and keeps each generated policy group under a 900-byte size budget.