... and? In an audited environment you'd carefully vet how the backups work. That functionality is inside the security boundary so to speak. I don't believe it

... and? In an audited environment you'd carefully vet how the backups work. That functionality is inside the security boundary so to speak. I don't believe it's integrated with (any bypass of) auditing but the same "ignore permissions" capability exists on Linux as CAP_DAC_READ_SEARCH and is primarily useful for the same sort of tasks.