Sandbox or virtualize everything does not eliminate the need to share data. Something control that permission, and it is the weakest link.

Either you end up with something don't work, too lax, or just DoS the user with permission dialog.