I think a permission model should have 3 choices for every question: allow, disallow, and pretend.
With the last option, app-makers cannot bribe the user into installing the app with unwanted permissions anyway.
For example, when the app wants file-system access, the "pretend" option would give the app a view of an empty or dummy (fake) file-system. When the app wants access to GPS coordinates, the "pretend" option would give the app dummy coordinates. Et cetera.
With the last option, app-makers cannot bribe the user into installing the app with unwanted permissions anyway.
For example, when the app wants file-system access, the "pretend" option would give the app a view of an empty or dummy (fake) file-system. When the app wants access to GPS coordinates, the "pretend" option would give the app dummy coordinates. Et cetera.