> Think of it like a silent observer inside the kernel — you can tell it what to watch, but not to take action beyond that.

What is the scope of this? Can any arbitrary program start monitoring what is happening in the system? If that is the case, then are their catch mechanisms to detect this and alert the user?