I might have misunderstood this part, isn't that the role of the xdg-portal which gives ephemeral access to whatever gives access to to the instance?