@dalias I wonder how close that would get to what the Android permission system tried to become before they realized it hampered their ability for the ad model to track users. Cross-API functionality was weird that way too: For an app to pause music/sound/the game you had to give it access to monitor phone calls/state? eek.
Some tried to mock or sandbox denied APIs so apps continued to function.
Browsers are also a variation of that type system model. If you squint hard enough.