1. A method in a broker service operating in a computing device, comprising: receiving, at the computing device, an access request related to first data of a file system in the computing device containing data from an application process, the application process being a launched version of an application, the application process residing in an application container that prevents direct access by the application process to the file system, the access request including a token for the application process that includes an identifier for the application container and an indication of the first data requested in the access request; and enabling access by the application process to the first data, through the broker service that is operating in the computing device by retrieving the first data from a file storage of the file system, when the broker service determines that a file type of the first data is included in one or more file types registered for the application as file types currently associated with the application that the application is allowed to access, the one or more file types read from an application manifest received during an installation of the application process, and indications of the one or more file types stored in a secure location in the computing device accessible to the broker service and not accessible by the application.