That sounds like the right way to do it. I would love a file browser that has no network permissions but special file permissions, and my network capable apps to have no extra file permissions beyond their own needs.