The macOS sandbox profile generator now groups deny and pin file-write rules that share a parent directory into combined regex patterns, splitting file-write-unlink/file-write-create handling from generic file-write* rules, and keeps each generated policy group under a 900-byte size budget.
Sandbox deny-rule grouping to shrink generated policies
The macOS sandbox policy generator now groups rules to keep generated policies smaller.
Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
Internal ChangesKind: in v2.1.261,
Internal ChangesSection of the release