Microsoft's solution to this in Windows Phone 7 is sandboxing the application and only allowing a certain amount of API calls which the user must confirm.