There's a notification for a write, but no authorization message for a write. Why is this? It's a pretty significant departure from kauth.
Endpoint Security Framework and writes -- why not auth event?