{"version":"2.1.261","anchor":"sandbox-deny-rule-grouping-to-shrink-generated-policies","canonical_anchor":"sandbox-deny-rule-grouping-to-shrink-generated-policies","heading":"Sandbox deny-rule grouping to shrink generated policies","tier":"internal","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.261\/e\/sandbox-deny-rule-grouping-to-shrink-generated-policies","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.261","markdown":"### Sandbox deny-rule grouping to shrink generated policies\n\nThe macOS sandbox policy generator now groups rules to keep generated policies smaller.\n\nThe macOS sandbox profile generator now groups deny and pin file-write rules that share a parent directory into combined regex patterns, splitting `file-write-unlink`\/`file-write-create` handling from generic `file-write*` rules, and keeps each generated policy group under a 900-byte size budget.\n\n- Area: Sandbox\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 1\/5"}