Unpacking macOS Security: SIP, TCC, Gatekeeper, and the Secure Enclave

Every macOS release ships a security note, and every one of them gets read the same unproductive way: skim the CVE list, note that nothing looks catastrophic, click update. That habit misses the more useful question. The individual patches change constantly, but the architecture they patch has been remarkably stable for a decade, and it is the architecture that determines what your application is allowed to do, what your CI pipeline will trip over, and what an attacker has to defeat to persist on the machine.