Random tangent I thought about at work today: what is the point of the executable bit on a file? Been using it for years, totally understand how it works, but I don’t think I know any of the history as to why that was a necessary permission to make explicit. Could we add more such bits to the world? “This file should never launch a process that can access the microphone / speaker / camera / internet / etc”

Yes; it's called SELinux

I think functional paradigm shows some great potential for permission management. Like application can listen your mic if you give your microphone stream as parameter. Or it can write to certain folders if you pass file write transactions to forward other applications (file system would be immutable of course).

Related; https://en.wikipedia.org/wiki/Object-capability_model

Sounds similar to what smartphones (Android) do with apps