Apple already takes this approach to limit some entitlements to web browsers on macOS. See the Passkey entitlement as an example:

com.apple.developer.web-browser.public-key-credential

https://developer.apple.com/documentation/bundleresources/en...