> SIP means not messing with the system files, enumerated thusly: /System.
...and all its children, which is effectively the entire operating system
> Enumerating what I do want an app to access is handled by Gatekeeper.
Gatekeeper is not capable of this.
