Just quickly thinking of where there might be a lot of images/documents modified quickly: web browser cache, photo management software, antivirus software.

I think it'd be easier to isolate applications and data like Cubes OS instead of trying to create a universal rule set.

https://www.qubes-os.org/intro/