RootGuard observes metadata changes globally, but user home directories are high-churn environments. Browsers, desktop shells, file managers, package sandboxes and applications routinely create, rename and chmod cache, profile, socket, lock and journal files.

The default split is therefore:

global home activity: audit;
trusted desktop/browser actors: logged as trusted, no popup;
protected system paths: enforceable by RootGuard;
user-data content protection: BastionGuard Anti-Ransomware.

Do not place a browser or desktop environment in [trusted-executables] merely to reduce event noise. That section participates in privilege-transition policy. Use [trusted-applications] instead.

An entry is resolved to the executable's device/inode at policy load. Package upgrades can replace that inode, which is why saving from the UI restarts the service and why a policy reload/restart is required after relevant application updates.

Trusted applications do not bypass [protected-paths]: only rule-zero global surveillance events are reclassified as trusted.