Thanks for the pointer, adding the missing reference: https://grapheneos.org/features#storage-scopes

This looks pretty interesting (and there's more GrapheneOS has to offer):

> GrapheneOS provides Storage Scopes as a fully compatible alternative to the standard Android storage permissions. Instead of granting storage permissions, users can enable Storage Scopes to make the app assume that it has all storage permissions that it asked for. On Android, an app that doesn't have any storage permissions is still allowed to create files and directories, and is allowed to access the files that it created. Users can optionally add files and directories as storage scopes to permit the app to access files created by other apps.

This comes pretty close to what I imagined, thanks a lot for providing this living example!