> Why not just ask for permissions for a single app specific folder?

Basically because Gmail A) doesn't have folders B) doesn't have permissions based on tags. Otherwise most Gmail API apps would have this option.

The same thing is a problem when you want to delegate access to an email account, where there should be a way to delegate access based on tags, but there just isn't.

What you can now do is create Gmail Add-Ons, which only have access to this specific thread that's open when you click to activate the add-on. E.g. this is how we created https://www.prettyfwd.com