That’s a hand waving if I’ve ever seen one.
How is that going to help?
If the Agent gets launched with is own user is will not have access to ANY of the files that are only read by the user.
Of course, as a user, you need some way to easily modify ACLs to do this, but that’s just a front end concern on top of a solid security model that every OS supports.
This is what dedicated higher-level APIs (like ScreenCaptureKit on mac or XDG portals on linux) are made for.
That is, a messaging app could expose separate conversations as separate files or directories in a virtual file system. File system permissions could then dictate which users can access a conversation.
A screen recording virtual file system can expose each window as a separate file. File system permissions would then dictate which users can enumerate all windows (permissions on the directory) and which users can see specific windows (permissions on the files).
If you take “everything is a file” far enough, it follows logically that controlling access to files lets you control access to anything.