1 files changed, 7 insertions, 16 deletions
diff --git a/src/Agent.Windows/Security/TaskAclManager.cs b/src/Agent.Windows/Security/TaskAclManager.cs
index f01e859..2b091a6 100644
--- a/src/Agent.Windows/Security/TaskAclManager.cs
+++ b/src/Agent.Windows/Security/TaskAclManager.cs
@@ -26,7 +26,13 @@ public sealed class TaskAclManager(SecurityIdentifier appContainerSid, ISecurity
         security.AddAccessRule(rule);
         WriteSecurity(canonical, security);
         if (journalEntry is not null) journal!.MarkApplied(journalEntry.Value);
-        audit.Write(new(DateTimeOffset.UtcNow, taskId, "acl.apply", "applied", new Dictionary<string, string> { ["path"] = canonical, ["sid"] = appContainerSid.Value, ["rights"] = rights.ToString() }));
+        audit.Write(new(DateTimeOffset.UtcNow, taskId, "acl.apply", "applied", new Dictionary<string, string>
+        {
+            ["path"] = canonical,
+            ["sid"] = appContainerSid.Value,
+            ["rights"] = rights.ToString(),
+            ["scope"] = directory ? "root_inheritance" : "file"
+        }));
         return new(canonical, original, journalEntry);
     }
 
@@ -39,21 +45,6 @@ public sealed class TaskAclManager(SecurityIdentifier appContainerSid, ISecurity
         audit.Write(new(DateTimeOffset.UtcNow, taskId, "acl.restore", "restored", new Dictionary<string, string> { ["path"] = snapshot.Path }));
     }
 
-    public void NormalizeNewEntry(Guid taskId, string path)
-    {
-        string canonical = CanonicalPath.Resolve(path);
-        FileSystemSecurity security = ReadSecurity(canonical);
-        security.SetAccessRuleProtection(isProtected: true, preserveInheritance: false);
-        foreach (FileSystemAccessRule rule in security.GetAccessRules(includeExplicit: true, includeInherited: false, typeof(SecurityIdentifier))
-            .OfType<FileSystemAccessRule>()
-            .Where(rule => rule.IdentityReference == appContainerSid)
-            .ToArray())
-            security.RemoveAccessRuleSpecific(rule);
-        security.SetAccessRuleProtection(isProtected: false, preserveInheritance: false);
-        WriteSecurity(canonical, security);
-        audit.Write(new(DateTimeOffset.UtcNow, taskId, "acl.normalize", "normalized", new Dictionary<string, string> { ["path"] = canonical }));
-    }
-
     private static FileSystemSecurity ReadSecurity(string path) => Directory.Exists(path)
         ? FileSystemAclExtensions.GetAccessControl(new DirectoryInfo(path), AccessControlSections.Access)
         : FileSystemAclExtensions.GetAccessControl(new FileInfo(path), AccessControlSections.Access);