> We are talking about what the user/application sees and is capable of accessing.

But how is that different than a filesystem?

Suppose we add application-based ACLs to file permissions. Then the app does open("/path/to/file", O_RDONLY) as ever. If the app has permission to the file, it gets the new fd. If it doesn't, it gets EACCES as usual. Or the OS displays a dialog asking whether the app should have permanent or one-time access to that file, and then the call doesn't return until the user chooses one.

I don't see a fundamental change here. The application wouldn't necessarily even have to be modified.