It would, but you run into all sorts of impedance mismatch. For example, how do you revoke and grant access to your photos folder to some applications, on deman

It would, but you run into all sorts of impedance mismatch. For example, how do you revoke and grant access to your photos folder to some applications, on demand? The straightforward way (create groups for each important folder access class) blows up in terms of size very quickly, and group changes don't really happen on-the-fly, either. Things can get even murkier when it comes to device access, and you also have to deal with all sorts of caveats like suid binaries. You also don't have the API required to easily deal with any of this (e.g. no simple API to prompt the user for permission to access a path, no simple API to retry access until the user either grants access or denies it etc.).