To some degree, I like this, but the experience for both to allow access is still pretty draconian. I'm not quite sure what the process is for Snap to adjust th

To some degree, I like this, but the experience for both to allow access is still pretty draconian. I'm not quite sure what the process is for Snap to adjust this (it might require a rebuild?), but I know for Flatpak it's common for folks to say "Use Flatseal to adjust the permissions of what the app has access to" to resolve problems like this. In an ideal world, the application would be Flatpak or Snapcraft aware (or there'd be a middleware to intercept these calls), and ask for access to parts of the system it needs.