i future, some kind of ACL for Anroid apps would be great. meaning, you can allow apps individual access outside of the VM.

e.g.
app1 can access internet, location
app2 can access media
app3 can access contacts

... and so on