That's exactly the direction I took with Filestash (https://github.com/mickael-kerjean/filestash) where everything is treated as a filesystem with fine-grained control to handle authorisation, plus a virtual filesystem layer to create completely new filesystems that don't 1 to 1 map to reality.