I'd like to see a faster version of isap and %@pid for use in loops to count process instances. Currently I'm using %@exepids from Vince's plugin, but it would be nice to see this in TCC directly. Perhaps you could use his method instead of enumerating the process list if no wild cards are specified.