Well that happens when it's bolted onto something not designed for fine-grained access.

It's much different when UX is built around it. E.g. for a web browser _has_ to treat web pages as untrusted. So instead of giving web page access to file system (that would be equivalent of `sudo`) you selected individual files/directories using a trust browser UI, and they are made available through particular APIs which are basically equivalent to ocaps. So if don't need to support POSIX APIs ("I WANT TO JUST fopen!!!") it's much easier.

> It's much different when UX is built around it. E.g. for a web browser

Why don't you run th e web browser as init then ?