Separate (some) user applications from the operating system

[Patrick]

For Apps Persmission: Default Block All

By default, when any app is installed in the VM, nothing is allowed automatically. Every permission including internet access must be explicitly granted by the user. This approach prevents any unwanted permissions from being applied silently without the user’s notice or consent. Inspiration for a graphical permission gears: