DesktopServicesHelper appears to delete or unlink the source file before the ESF auth event deadline is reached, rather than waiting for the full deadline window.

On macOS Tahoe, our application using the Endpoint Security Framework (ESF) observes that during file copies through finder application, DesktopServicesHelper unlinks the source file if the ESF authorization response is delayed for ~5 seconds, even though the authorization event deadline remains 15 seconds, indicating that the process does not wait for the full ESF deadline before deleting the file.

Before Tahoe, we didnt see this behaviour.