As an example, Flatpak has "portals" for e.g. file access, which mirror how this works on mobile OSes. The app asks the environment to let the user pick a file, then the file gets mapped into its sandbox.