system.volume.removable. - Overview of the macOS Authorization Right
macOS 10.8 / 10.9 / 10.10 / 10.11 / 10.12 / 10.13 / 10.14
{
'class' : 'rule',
'comment' : 'system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount)',
'k-of-n' : '1',
'rule' : [
'is-root',
'is-admin',
'on-console',
'authenticate-admin-30'
]
}