Glossary
PPPC and MDMOverrides.plist
Privacy Preferences Policy Control profiles let MDM pre-approve TCC services; the grants are reflected in MDMOverrides.plist next to the system TCC.db.
Privacy Preferences Policy Control (PPPC) is the configuration profile payload an MDM server uses to pre-approve TCC services for specific apps, typically security and management agents. The resulting grants are reflected in /Library/Application Support/com.apple.TCC/MDMOverrides.plist: a dictionary keyed by client, then by service, with keys such as Allowed, CodeRequirement, CodeRequirementData and IdentifierType.
PPPC cannot silently grant camera, microphone or Screen Recording. An unexpected profile is a finding in itself. See TCC.db forensics: the investigator's guide.