Third-party apps could provide a custom UX to sensitive data by providing a separate executable that the device's OS then runs in a sandboxed process with read-

Third-party apps could provide a custom UX to sensitive data by providing a separate executable that the device's OS then runs in a sandboxed process with read-only access to your sensitive data and without the means of communicating anything with the source app's process. When the user has completed whatever task the sandbox was needed for (e.g. finding a photo from your entire camera-roll or picking contacts) the sandboxed third-party code indicates the selection to the host OS who then does a quick "confirm you want to use these 3 photos?" prompt and then releases only the selected data. ...basically something like WinRT's broker-processes on steroids - or another use case for Apple's "App Extensions" feature but allowing for complete control of the UX more akin to a Photoshop Plugin than being limited to a small number of prescribed use-cases.