Permissions problems with running rsync via periodic or via launchd in Catalina

Question

So, I've got some scripts that use rsync to periodically backup folders on my MBP, but once I moved to catalina they stopped working when invoked by periodic or by launchd.

This is clearly a permissions thing because the scripts work fine when I run them by hand. The problem is, I can't figure out what I need to give permissions to... any ideas?

Here's a sample of the scripts:

#!/bin/bash

DESTDIR="/Volumes/GoPro Video"
DESTINATION=$DESTDIR

# Source is relative to the home directory.
SOURCEDIR=/Users/michaelheinz/Movies
SOURCE="."

OPTIONS='-rltPW --relative'

echo "cd \"$SOURCEDIR\"; rsync $OPTIONS \"$SOURCE\" \"$DESTINATION\""

(cd "$SOURCEDIR"; rsync $OPTIONS "$SOURCE" "$DESTINATION"; if [[ $? -eq 0 ]]; then echo SUCCESS; else echo "FAILURE"; fi) 2>&1 | tee /tmp/$$.log

LOGFILE=$(basename ${0})
mv /tmp/$$.log /var/log/mwh/${LOGFILE}.mwh

A typical error might be:

[Matilda bin]> cat /var/log/mwh/sync_gopro_videos.mwh 
building file list ... 
147 files to consider
./
rsync: failed to set times on "/Volumes/GoPro Video/.": Operation not permitted (1)
rsync: failed to set times on "/Volumes/GoPro Video/.": Operation not permitted (1)

sent 3703 bytes  received 26 bytes  7458.00 bytes/sec
total size is 24761084481  speedup is 6640140.65
rsync error: some files could not be transferred (code 23) at /BuildRoot/Library/Caches/com.apple.xbs/Sources/rsync/rsync-54/rsync/main.c(996) [sender=2.6.9]
FAILURE
[Matilda bin]> 

dmesg reports lines of messages like this:

System Policy: deny(1) file-read-data /Volumes/APFS-Photos/Libraries/2020.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-walSandbox: rsync(36610) 

This is from a job that ran today, I also have had jobs fail outright because the job doesn't have permission to access an external drive. I've tried giving full disk access to periodic, to rsync, and to the scripts themselves. (I've also partially worked around the issue by moving some folders to /Users/Shared/ but that isn't practical for all cases.

I've tried running the script from a launchd plist in /Library/LaunchDaemons with UserName set to root, set to me, running from periodic, adding the rsync binary to Full Disk Access, nothing seems to help.

Any ideas?