Keychain ACLs on macOS use the codesigning requirement of the executable requesting the secret.