A new sandbox setting lets users specify additional XPC/Mach service names to allow, supporting tools like 1Password CLI, Playwright, or other system services. Supports trailing-wildcard matching (e.g., "2BUA8C4S2C.com.1password.*").
Evidence
Mach service setting (search for "macOS only: Additional XPC/Mach service names")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.