But it doesn’t sound like bypassing the “constraints imposed for security” is the desired outcome for the bosses, so who are you selling to?
A JavaScript application could be anything that loads in a webpage but not necessarily from a server or domain. That could mean pasted into the console as you suggested, a SharePoint utility, any web page that does not sending data to the server, as well as pages opened from the local file system.
The primary considerations for success are high portability, data saved in the browser’s localStorage, applications that execute in the browser as opposed to on a server, no dependencies, and high performance.
If I were to do this as a real business I would always impose formal language training in the JavaScript language, so prior JavaScript experience is a largely irrelevant indicator of compatibility. That is because experiences writing the language professionally vary wildly in the market place and quality of code authorship is exceedingly rare. Producing high quality output is not challenging, but most people doing this for a job completely lack proper guidance or shouldn't be there in the first place.
Therefore the most ideal candidates are people who can be trained to a very high standard. I would filter for that first and then optionally filter for clearance secondly. You will be investing in these people so be choosy by potential, intelligence, writing skills, and organizational capacity.