[quote='881033022, robonaren, /thread/819553?answerId=881033022#881033022, /profile/robonaren'] Here are the specific requirement i've tried [/quote] So anchor apple generic is definitely wrong. Consider this quote from Code Signing Requirement Language: For Apple’s own code, signed by Apple, you can use the short form anchor apple For code signed by Apple, including code signed using a signing certificate issued by Apple to other developers, use the form anchor apple generic If your goal is security, you don’t want to mix these up! [quote='881053022, robonaren, /thread/819553?answerId=881053022#881053022, /profile/robonaren'] Here are the specific requirement i'm using from the Authorization Plugin (xpc client) [/quote] From the client? Maybe I’ve misunderstood this, but that seems backwards. You want to apply these constraints on the server for connections coming from the client. Consider this: % csreq -r '=anchor apple and (identifier com.apple.authorizationhosthelper.arm64 or identifier com.apple.authoriz