This is mostly how the Mac sandbox handles file access actually, by going through blessed, OS-controlled file access dialogs. They call it “Powerbox”: https://developer.apple.com/library/archive/documentation/Se...

IIRC flatpak has something similar too, though I believe it’s opt-in for the apps.