I feel you! We thought about this and all apps will have a permission model. So you can limit it to specific file disk locations, domains for network requests, and so on.
Definitely a good initiative though. I like how coding harnesses do it, showing you the exact command that would run, or running it in a sandbox first.