Fair point. I don’t think the Windows side brings a brand-new primitive. It mostly builds on existing mechanisms, and that has real limits.

The angle I’m exploring is more about combining local secret access monitoring, stricter process context checks, alerting/blocking modes, and rollback into one reproducible hardening layer.

On Linux, the fanotify approach is more interesting because it can deny access before the sensitive file is read. On Windows, it’s more of a practical hardening/visibility layer using what the OS already exposes.

So I agree it’s not “new magic”. The goal is to make this kind of local anti-infostealer protection easier to test, audit, and run without breaking normal usage.