Deploying Script (or something) to Allow Accessibility Changes on Non-Admin Accounts

Take a look here:
https://jamfnation.jamfsoftware.com/discussion.html?id=9102

Disclaimer: I haven't tried the instructions outlined in the above thread on Yosemite, so I don't know if this still works. It probably does, but you'll need to test it out and see. (I'm assuming you may need to do this on 10.10 Macs)

via tccutil.py

# Add app to Accessibility database using the bundle ID
sudo tccutil.py --insert com.smileonmymac.textexpander
# Enable (if necessary)
sudo tccutil.py --enable com.smileonmymac.textexpander

via the built-in sqlite3 command:

sudo sqlite3 /Library/Application Support/com.apple.TCC/TCC.db "INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.apple.RemoteDesktopAgent',1,1,1,NULL)"

Just replace the bundle ID for whatever your application is.

+1 for tccutil.py it's been working great for me over the last six months

Neither solution works in Mac OS Sierra because TCC.db is now protected by SIP. :(

Nope. =(

Does anyone have any idea on Sierra (since it is read only now) how we can add jamfAgent with the box checked in Accessibility?

If you are willing to disable SIP, the aforementioned solutions should still work,

Any solutions in the past 6 months, clever or otherwise, for managing this? #ObviouslyNotWillingToDisableSIP #HostileUserExperience

How are we supposed to manage apps that require access when we restrict users from changing the Security & Privacy prefpane (and why is this specific feature there instead of under Accessibility where it used to reside?)

Another 6+ months.

Also not going to disable SIP. How are others dealing with this? Manually setting individual machines (for hundreds/thousands of machines)?

So no way to accomplish this without disabling SIP? It looks like we now need to do this for Lanschool on our 2400 student Macs.