Thanks for this, I didn't realise you could do this in CM. You can also check when the permissions were being used. For the Netflix app I noticed the "record audio" permission had never been used, but I've set it to explicitly ask me if it tries to use it.