You’d send the mdm payload or have the user manually allow that TCC/PPPC category for either osquery itself or the launcher you use if you’re wrapping it