Everything else can be a symlink to that location.

Possibly should be upgraded to "Everything else MUST be a symlink to that location." if it's needed for the EndpointSecurity entitlement?