diff --git a/Storage/FileBundle/FileBundle.cpp b/Storage/FileBundle/FileBundle.cpp
index a9205a4d3..7b2982525 100644
--- a/Storage/FileBundle/FileBundle.cpp
+++ b/Storage/FileBundle/FileBundle.cpp
@@ -26,11 +26,23 @@ std::optional<std::string> LocalFSFileBundle::key_file() {
 	return key_file_;
 }
 
+void LocalFSFileBundle::set_permission_delegate(PermissionDelegate *const delegate) {
+	permission_delegate_ = delegate;
+}
+
 Storage::FileHolder LocalFSFileBundle::open(const std::string &name, const Storage::FileMode mode) {
-	return Storage::FileHolder(base_path_ + name, mode);
+	const auto full_name = base_path_ + name;
+	if(permission_delegate_) {
+		permission_delegate_->validate_open(full_name, mode);
+	}
+	return Storage::FileHolder(full_name, mode);
 }
 
 bool LocalFSFileBundle::erase(const std::string &name) {
+	const auto full_name = base_path_ + name;
+	if(permission_delegate_) {
+		permission_delegate_->validate_erase(full_name);
+	}
 	return !remove((base_path_ + name).c_str());
 }
 
diff --git a/Storage/FileBundle/FileBundle.hpp b/Storage/FileBundle/FileBundle.hpp
index a4357487f..10587b6a5 100644
--- a/Storage/FileBundle/FileBundle.hpp
+++ b/Storage/FileBundle/FileBundle.hpp
@@ -23,11 +23,17 @@ namespace Storage::FileBundle {
 	bundles in the future.
 */
 struct FileBundle {
+	struct PermissionDelegate {
+		virtual void validate_open(const std::string &, FileMode) = 0;
+		virtual void validate_erase(const std::string &) = 0;
+	};
+
 	virtual std::optional<std::string> key_file() = 0;
 	virtual FileHolder open(const std::string &, FileMode) = 0;
 	virtual bool erase(const std::string &) = 0;
 
 	virtual std::optional<std::string> base_path() = 0;
+	virtual void set_permission_delegate(PermissionDelegate *) = 0;
 };
 
 
@@ -39,10 +45,12 @@ struct LocalFSFileBundle: public FileBundle {
 	bool erase(const std::string &) override;
 
 	std::optional<std::string> base_path() override;
+	void set_permission_delegate(PermissionDelegate *) override;
 
 private:
 	std::string key_file_;
 	std::string base_path_;
+	PermissionDelegate *permission_delegate_ = nullptr;
 };
 
 };