If you are using Linux, this sounds like a job for fatrace (which uses the fanotify API). Here is some sample output:
sh(28980): C /bin/bash
cron(28974): CW /tmp/tmpf807Y78 (deleted)
cron(28974): C /lib/x86_64-linux-gnu/security/pam_unix.so
cron(28974): C /lib/x86_64-linux-gnu/libcrypt-2.13.so
cron(28974): C /lib/x86_64-linux-gnu/security/pam_deny.so
This tells us, for example, that cron did a close-write on `/tmp/tmpf807Y78`.
If fatrace turns out not to be adequate for your use case, you could look up alternative clients of the fanotify API.