Platforms can implement that and some already have, e.g. Facebook’s auth works like this. That being said, this approach requires monitoring and enforcement; o

Platforms can implement that and some already have, e.g. Facebook’s auth works like this. That being said, this approach requires monitoring and enforcement; otherwise nothing prevents the developer from not allowing the user to proceed without granting some specific permissions. Facebook again seems relatively strict here, at least post- Cambridge Analytica.