There are in-between models, such as: * Android's permissions model where the user must approve specific potentially undesirable classes of actions (separate f

There are in-between models, such as: * Android's permissions model where the user must approve specific potentially undesirable classes of actions (separate from the 24H delay, etc controversy) * Optional sandboxing