Introduced in Catalina to enable ‘privacy by user intent’, these contain header-UUID pairs, with the UUID identifying the app granted access. But UUIDs change with every restart, so can’t be used to track access prior to the current session.
MACL
Why do so many files now have quarantine and other extended attributes, although they’re not apps, and may never have left that Mac?
The behaviour of quarantine flags, SIP flags, and the mysterious new com.apple.macl attribute, which never ceases to puzzle.
The Eclectic Light Company 