Thanks, Helge. Seems like I missed that /usr/libexec/cups was an exception. I'm not trying to "defeat SIP," I want to work within it - properly. Back to my reading...