You could remove the need to explicitly specify the permissions somewhat by enforcing semver for permission addition. If you own a package at version 1.X.X and

You could remove the need to explicitly specify the permissions somewhat by enforcing semver for permission addition. If you own a package at version 1.X.X and you want to add a permission requirement you have to bump the version to 2.0.0. If you also allow people to opt in to a less strict "auto allow all the currently required permissions for these dependencies" mode, they would at least know for sure nothing can touch anything new unless they explicitly bump the major version. If you're extra concerned about security you can explicitly specify them so it's really obvious when a major version bump adds new ones, but it removes some of the friction.