I like this option, similar to how apps request permissions on a mobile OS. There could be a default list of modifications an external javascript script can run, any further access must be explicitly white listed by the developer. Then even if the script was malicious, at least the impact is controlled.

for instance, maybe the default is that an external script can read the DOM but needs extra permissions to write/modify it?