I don't know how to view specific TCC restrictions, and I don't know of any way to view the full sandbox profile applied to the current app, but in some quick t

I don't know how to view specific TCC restrictions, and I don't know of any way to view the full sandbox profile applied to the current app, but in some quick tests it sure looks like the core issue is Apple applied this sandbox rule: (deny file-read-data (home-subpath "/Library/Safari")) when it probably should have done something like (allow file-read-metadata (home-literal "/Library/Safari")) (allow file-read-xattr (home-literal "/Library/Safari")) (deny file-read* (home-subpath "/Library/Safari")) This means you can't enumerate a directory as that's "data", but you can stat individual paths as that's just metadata.