> It isn't Android that makes this inconvenient. It is the app developers that cause "prompt fatigue" (by showing permission requests repeatedly) or "blackmail" by refusing to work until permissions are granted. A new sandbox mechanism is unlikely to change much.

That's why spoofing should be an option. You want GPS? Timbuktu. You want my camera? Here's a close up video of a saggy scrotum. You need access to my contacts? Here's an address book with the contact details for all the funeral services within a 50 mile radius.