Yes on a new privacy setting. Bonus points for having policy settings that depend on both source and destination, e.g. a custom policy for a string that originates in a password manager.
I don't like the direction where this is going. We've created an adversarial situation, where software developers go against users and against each other and then instead of fixing that, we keep destroying features of cooperation and interoperability in the name of "security" and "privacy".
sandboxed apps may only access a file outside of the sandbox via an explicit user interaction with a system UI element, i.e. drag-and-drop a file via OS X drag-and-drop API, select a file in iOS / OS X owned file dialog, share sheets, etc.
I wouldn't mind if I opened an app and got a one-time dialog "This app is trying to access your clipboard. Do you want to allow it?"