My idea is that if they try to access your contacts, instead of receiving a potentially unhandled "access denied" exception, they should just receive an empty contact list. Et cetera.