Determine which macOS automation actions require TCC privacy permission prompts (Accessibility, Screen Recording, Full Disk Access, Automation) versus which can run unprompted

Steps

1. Consult Apple's Privacy Preferences Policy Control (PPPC) services list, which enumerates the TCC service identifiers (e.g. Accessibility, AppleEvents, ScreenCapture, SystemPolicyAllFiles) that gate specific categories of automation.
2. Treat any script that sends Apple events to another app (osascript or JXA targeting another app) as needing the Automation/AppleEvents TCC category, which is granted per requesting-app/target-app pair.
3. Treat any script that simulates clicks/keystrokes or reads UI elements via System Events/accessibility APIs as needing the Accessibility TCC category.
4. Treat any script that captures screen content or window images as needing the Screen Recording TCC category.
5. Treat any script that reads files outside sandbox-safe locations (another app's container, Mail, Messages, Time Machine, etc.) as needing Full Disk Access.
6. For unattended automation (cron-less scripts run via launchd, remote SSH, or CI), grant these permissions once interactively or via an MDM-deployed PPPC configuration profile, since TCC consent dialogs generally require a logged-in GUI session to approve.