This is actually how it is implemented in OSX. If a sandboxed app shows a 'file open' panel then it automatically obtains the rights to read and write to any file selected (the open panel, or 'powerbox' as it is called, is implemented in a separate process so cannot be manipulated by the app). An app can also request a secure 'bookmark' to this file so it can persist file references.