Here's what I did to get around this problem: I went back to an old version of my app, which was built without any of the sandboxing and entitlement requirements, reinstalled it and launched it, and it triggered the alerts to allow communication with Illustrator and Finder. Then I re-installed my new version and it rode in on the coattails of the old one. I had a colleague try the double-install trick on a fresh remote computer and the workaround was successful, but very kludgy. I would love to get to the bottom of this so I can provide a better user experience. This hack is somewhat less than acceptable in the long run. I would greatly appreciate any more suggestions!

Thanks for your help. I added Temporary Exception Entitlements as instructed in the docs, and after reading a bit further added Scripting Targets. I still have the same problem, but with different error messages. Finder and Illustrator processes give me this: Since sending application [sess=100017 pid=25738 uid:501,501,501 g:20,20 pV:70839] is not permitted to send this AppleEvent to this process, returning an errAEEventNotPermitted reply. Under the tccd process I get this: AccessRequestIndirect: Policy disallows prompt for com.skyline.scaperapp; access to kTCCServiceAppleEvents denied This is my Entitlements file: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.security.app-sandbox</key> <true/> <key>com.apple.security.automation.apple-events</key> <array> <string>com.apple.finder</string> <string>com.adobe.illustrator</string> </array> <key>com.apple.security.temporary-exception.apple-events</key> <array> <string>com.apple.finder</string> <string>com.adobe.illustrator</string> </array> <key>com.apple.security.scripting-targets</key> <dict> <key>com.adobe.illustrator</key> <array> <string>Application</string> <string>Document</string> <string>Text</string> </array> <key>com.apple.finder</key> <array> <string>Standard</string> <string>Finder</string> <string>Container</string> <string>Desktop</string> </array> </dict> <key>com.apple.security.network.client</key> <true/> <key>com.apple.security.network.server</key> <true/> </dict> </plist> I launched the app from a signed and notarized DMG. What can I possibly do next?