The application seems to be signed and notarized correctly, my assumption is that there was some record of a development build using the same app identifiers (like I said, no issues when running a development build) To answer your questions: The FileProvider does have the Sandbox capability I am using a Distribution provisioning profile I can confirm the signing certificates are still valid Yes, the main application is within the same App Bundle as the File provider extension

The issue is not with accessing files via the URL received from NSFileProviderManager getUserVisibleURL(for itemIdentifier: ) , the issue is that the call to getUserVisibleURL itself throws the error "The file “...” couldn’t be opened because you don’t have permission to view it." I have no URL to start accessing with a security scope.