Disabling SIP Using Netboot?

Instead of disabling SIP to install something (which is not good practice) you can just add the packages with your settings into a Configuration and make sure you don't check the "Erase Target drive" box. Then just boot your systems to imaging and run the configuration (or have the autorun data set).

Not sure if this will work for you, but it worked for my issue with Apple Logic receipts.

I ended up just creating a LaunchDaemon and a script. Seems to do the job.

#!/bin/sh
#Inserts code into TCC.db inside ~/Application Support/com.apple.TCC/TCC.db for OSAScript Accessibility 
#Get Logged In User
loggedInUser=`/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'`
checkTCCdone()  {
        if [ -e /Users/$LoggedInUser/Library/Preferences/TCCdone.txt ] ; then
    echo "TCC.db has been modified."
        exit 0
        fi
}

configureTCCset() {
/usr/bin/sqlite3 /Users/$loggedInUser/Library/Application Support/com.apple.TCC/TCC.db "INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','/usr/bin/osascript',1,1,1,NULL,NULL)"
/usr/bin/touch /Users/$loggedInUser/Library/Preferences/TCCdone.txt
}

checkTCCdone
configureTCCset

exit 0