[alphazard]

But what about for state that the application doesn't really "own"? e.g. I want to open a PDF in an editor. The PDF is in my documents folder, and I don't want to expose all of my documents to the application in its sandbox.

Fine grained access to single files should be given out using a file picker. The application manager passes in a socket to the application sandbox. The application connects to that socket using a known hard-coded path. It sends a message (client->server) over the socket, the listening file picking process opens a new GUI window to prompt the user to select a file. The user picks a file and a file descriptor is sent over the socket to the application (server -> client).