What about filesystem access rights? Does any application have full access to all user's files? Or only to files belonging to this particular application?

Applications will each have their own namespace, and will only have access to user files if given the right to, on a per directory/file basis