Sierra Keychain issues

Hi all, hoping to get some insight into a keychain issue that has cropped up in Sierra (10.12.x) Note, all code involved worked fine in 10.11.x, and I'm using XCode 8.2.1. The code is Swift 3.

So my app is split into two components, a framework and the main app, both written in Swift. In the framework I have my keychain code. Basic keychain read/write functionality. Works fine in OSX and iOS.

Now in Sierra, when my app goes to write to the keychain I get: Error writing to keychain: Error Domain=NSOSStatusErrorDomain Code=-34018. Code -34018 is missing entitlements.....

This is running in a development debug session, so I'm just using my personal team code signing.

So I figure I need to add an entitlement file, but what entitlement does it need? In the Xcode project Capabilities tab I only have "App Sandbox" and "App Groups". I've tried both, and no change.

Any ideas? Ironically, when we build the app in CI, using my company's Enterprise certs it works. However, this doesn't work for development. Like I said, I'd really rather use the personal team code signing, but I'm at a loss of where to go next.

Thanks