I don't know if that's how I'd describe it but, but one thing Android has is that each app needs to assert the capabilities it needs to run (can make phone calls, can keep the phone from sleeping, can access GPS info, can read anything on the sd card, will store data on the sd card, etc), and will not be able to do things it doesn't assert it needs in the manifest (this was actually a minor problem early on because the string for GPS access was unknown/documented wrong). And at least at install time, users can see these permissions so they can be aware of what they are getting into.