Giving Scripts a Capability Instead of a Secret: Testing Apple's ManagedApp Framework
A proof of concept for delivering an API credential through Declarative Device Management and letting a signed broker use it, so MDM scripts can trigger an authenticated request without ever holding the secret. Includes the signing, install-behavior, and asset-hosting problems that cost me most of two days.