The summary.
THE SYSTEM VOLUME IS SIGNED AND READ-ONLY
You cannot write to system locations even as an administrator. Your own items belong in the library at the root or in a user's own library.
MANY APPARENT FAULTS ARE CONSENT THAT WAS NEVER GRANTED
The privacy settings govern access to files, camera, microphone and control of other applications — check them before deeper diagnosis.
Access control lists override ordinary permissions, which explains access that seems inconsistent.
THE DEFAULT SHELL AND UNIX TOOLS DIFFER FROM LINUX
Options differ, and scripts written for Linux fail subtly. Install current versions separately and declare them explicitly.
USE THE SYSTEM LAUNCH MECHANISM FOR SCHEDULED WORK
It handles machines asleep at the scheduled time, which the older Unix scheduler does not.
Review loaded definitions periodically — unrecognised ones are a common persistence mechanism for unwanted software.
ENABLE DISK ENCRYPTION ON EVERY PORTABLE MACHINE AND STORE THE RECOVERY KEY SEPARATELY
Without it an encrypted disk is unrecoverable.
ENROL WORK DEVICES WITH ORGANISATIONAL ACCOUNTS, NEVER PERSONAL ONES
A device left activation-locked to a departed employee is unusable.
