Unless you wanted to submit this to the Mac App Store, you could have just turned off sandboxing. With that off, the only permission required would be Catalina’s permission dialogs when any app first accesses various folders (Documents, etc.), and those are automatic without needing any code in the app to request them.
I thought I could locally, but it crashed on her machine which makes me think I did it wrong. I could have kept at it but I think one debugging session on her computer would have wiped out any time savings she would have realized.
This is apparently like a DEFCON 0 type operation to perform on a Mac requiring two guys in white lab coats to turn keys at the same time at opposite ends of the room, because there was no way to even ask for the permission to run the command if I remember right. It ended up being a case where I would be spending a ton of time to get more functionality than the command line script, so I quit. Plus it was one of those one plane ride projects.