I agree, but part of it I think is more finely grained permission requests. ie. Distinguishing viewing X's data, vs viewing data as X. That still doesn't solve

I agree, but part of it I think is more finely grained permission requests. ie. Distinguishing viewing X's data, vs viewing data as X. That still doesn't solve the issue where the typical person doesn't actually read permission requests, but should still provide better security.