Does this beat self-stewarding my data, and placing relevant protections around my data instead.

Then the UI's, the "Apps", are just ephemeral instances over my live data whose permission I am consistently setting or reviewing.

I feel like that more accurately represents a "person" behind the data: when I am producing, creating and expressing in real life, I do not ask some intermediary 3rd-party for permission to access my voice and my output. I just produce and let whatever gets created be made there in the physical environment or in someone's head. Today's apps (edit: & cloudflare's direction here) feel more like "The moment I express or generate something, I lease it's output from someone else and ask for their permission to access my output".