Explicit as in when you run a new app it does not have access to any of your files and there is no way for it to gain access without you, the user, giving it.

Explicit as in when you run a new app it does not have access to any of your files and there is no way for it to gain access without you, the user, giving it. >Does clicking a file count? Yes, clicking a file from the file picker counts. >Asking for code reformatting across the project? You can grant access to a directory in that case. >How long does access last? How is it revoked? It can last forever or until the application is closed. There is room to choose how exactly it could work. >If the user runs "reformat project" once, then gets a new version, are try going to have any warning that "reformat project" is about to encrypt every file it touches? That would be up to the design.