It is! The directory grant is once and the sandboxed app can save the bookmark for the future access. As a agent program, you can display this so users can revoke / temporarily disable access for a period of time: https://developer.apple.com/documentation/foundation/nsurl/s...

Agree, I think for CLI harness, there is no good alternative, you either have access permit per terminal app (which is not ideal), or I guess that is what Apple means they will "address" it?