``` Sandbox: bash(918) System Policy: deny(1) file-read-data /Users/hton/Documents ``` Osquery query unified logs for TCC failures.