In ptrace-based intercept mode, the software fails to apply intercept policy checks to the `execveat` system call. This allows users who are permitted to run specific commands to execute denied programs by calling `execveat` directly or through `fexecve`, which bypasses policy enforcement and logging.