Actually not far from how it works on macOS. Usage of a system "open file" dialog automatically creates a permission for the application to access that file from inside its container.

https://developer.apple.com/library/archive/documentation/Se... (search for "Powerbox")