Unlike on iOS, we are unable to determine access per app at a file level on MacOS (OSX). The permissions are at a folder level. Thus, if we give access to the Documents folder today and then pick a single file, the app is actually free to scour the Documents folder and act on its own (scan the meta data of all the files, upload all the files somewhere, for e.g.)