I can get the app to work when notarized for local distribution by doing: <key>com.apple.security.temporary-exception.apple-events</key> <string>com.apple.Safari</string> But I'm guessing that's not going to fly with App Review?

Thanks. Sadly the proposed configuration doesn't improve things. A notarized local distributed version of the app still does not prompt for permissions and the AppleScripts fail to run. The more reading I do about this the more I am confused. Safari doesn't provide any access groups, right? So the way you are proposing above with an empty array asks for what kind of access to Safari? All or none? All Chrome browsers have good AppleScript support so it's very similar to get the URL and Title.