So Windows doesn't have an equivalent of OSX Keychain, where an item can have a per-application ACL? [or I have misunderstood the OSX Keychain]
On macOS, applications address spaces are isolated and code signing certificates are used for identifying application requests to the keychain.