Try this experiment: 1. Write a macOS app that has a button which uses the file open window to load a document. 2. Enable the app sandbox by adding the releva

Try this experiment: 1. Write a macOS app that has a button which uses the file open window to load a document. 2. Enable the app sandbox by adding the relevant entitlement. 3. Prove to yourself it works by adding some code that directly fopen()s a file in your home directory and watching it fail. 4. Open that file by clicking the button and selecting it in the open dialog. Observe that you can now read it. Or just go read Apple's documentation that explains their capabilities architecture in detail. Look for docs on sandbox extensions and Mach ports.