[saagarjha]

Entitlements cannot protect against things in your own process. They are always used to gate clients either across a kernel-user or XPC boundary.

[jiveturkey]

isn't that exactly what the parent was asking for? limiting syscalls.

EDIT: oh. but not limited to the caller from a specific system library.