Very cool! We're also considering building a mac app, that elegantly solves all the access control / compliance concerns

The downside is that in client-only arrangement state is no longer centrally managed; I wonder how do you solve that? Or do you have a "hybrid" model with some parts on the client and others on the server?

So everything is done between the client app and AWS. Under the hood it is using the AWS SDK. We don't store any keys or any of your data on our servers. So, the user has to have access keys, and they can also have their session token. We also have it setup that it can read from your .aws/credentials file, so if you have a process that automatically updates that file, the session token is also automatically updated in the app.