Right now nodelocal simply maps to the external IO dir, but since all access is done as the server process, this means there is no user-level access control the way there is with, say, s3 where the user can bring their own tokens.

The current system is useful in some cases but to be more generally useful in multi-user deployments, we need to make it user-aware: it should be a grantable privilege to interact with nodelocal files at all and users should only be able to interact with their own files. We potentially could also want quotas on nodelocal usage, though until table usage has quotas it is a moot point (you could just store your files in a blob columns).