Look in Activity Monitor or the log, and you won’t find anything named Gatekeeper, is its a team of different systems, each of which can work on its own. Here’s the detail and a diagram.
quarantine
First full release version, which conforms to macOS clearance convention, and lets you know which flags it has changed.
How this occurs, why, and what to do to manage the problem when it affects you. Complete with a visual summary and references.
Try using this workaround: it requires quick actions, and despite Apple’s promise, it only works until you next save the document.
This utility changes quarantine flags on documents as if XProtect had checked and cleared them, so they work normally again. First beta.
Full release of Sandstrip, a utility to remove the quarantine flags attached to documents by sandboxed apps.
How a security feature trying to block malicious documents has rendered a Finder feature useless, causing users and developers problems.
Two sets of log excerpts demonstrate how macOS can prevent a user from opening a document, then mislead them into thinking it’s the app at fault.
You double-click to open a document, and see a security alert telling you it’s from an unidentified developer and your security settings prohibit opening. What the hell?
Second of two, here looking at quarantine of documents, what it means, how it occurs. Much more common than apps, but mysterious.
The Eclectic Light Company 