Security-scoped NSURL bookmarks on Xcode Server

In the unit tests for my app, I create an app-scoped NSURL bookmark, and then a document-scoped one from it, because the part of my app I'm testing expects that. These tests have always worked correctly on my machine, but are now failing when run on an Xcode Server bot. I don't codesign the unit test bundle, but tried doing so as a troubleshooting step, which made no difference.

NSError *error = nil;
NSURL *originalURL = [NSURL fileURLWithPath:@"gitrepo/path/to/a/file.txt"];
NSData *appScopedBookmark = [originalURL bookmarkDataWithOptions:NSURLBookmarkCreationWithSecurityScope
                                  includingResourceValuesForKeys:nil
                                                   relativeToURL:nil
                                                           error:&error];

NSError *docScopedError = nil;
BOOL isStale = NO;
NSURL *url = [NSURL URLByResolvingBookmarkData:appScopedBookmark
                                       options:NSURLBookmarkResolutionWithSecurityScope
                                 relativeToURL:nil
                           bookmarkDataIsStale:&isStale
                                         error:&docScopedError];

XCTAssertNil(error, @"Error while resolving app-scoped bookmark");

[url startAccessingSecurityScopedResource];

NSURL *relativeToURL = ...
NSData *bookmark = [url bookmarkDataWithOptions:NSURLBookmarkCreationWithSecurityScope
                 includingResourceValuesForKeys:nil
                                  relativeToURL:relativeToURL
                                          error:&docScopedError];

[url stopAccessingSecurityScopedResource];

XCTAssertNil(docScopedError, @"Error while creating document-scoped bookmark from URL:\n%@\nrelative to: %@",
             url, relativeToURL);

The final assertion fails, and the message that gets logged verifies that both URLs are not nil, and I was able to verify that both files do exist. They are both contained within the Git checkout directory, which the account has full access to. The relativeToUrl points to a file created earlier in the test.

The NSError produced has the following info:

"Error Domain=NSCocoaErrorDomain Code=256 "The file couldn’t be opened." (Item URL disallowed by security policy) UserInfo=0x10691c6d0 {NSDebugDescription=Item URL disallowed by security policy}"

What security policy could it be referring to, and how would I update it?