That makes a lot of sense. With the icon method: The user is in full control.

In our case, the CLI is part of a data sync system, so it does need a "special" once-per-hour check for new data (keeping local and mobile in sync).

I've actually been surprised how strict Apple is before it will happily let signed code run. But the average user (including me previously) doesn't know that. I think trust comes down to being clear up front.

Note to self: Add extra details/options to installer (WYSIWYG)