macOS has been informative auth window for ages - who requests the sudo / TouchID ? Sometimes macOS shows the app name or icon, but not always and not the call chain.
With agents running in the background, this only gets more acute. Now any sudo / local authentication requestor
