Why should the permission even persist that long? You might leave that app running for the next two years.

Shouldn't a temporary access be temporary? Possibly scoped by time? Possibly scoped to a single access?

Because the app may generate more than one descriptor for it or perform more than one read or write operation in the normal course of usage. If I open a document, and come back to it 6 hours later and click the save button, I would expect it to save the document.