I am awaiting amazon to get my device, but I'd like something like a sandbox mode, so I can install say a new contact manager app but one that can't talk to the internet, so I know it can't steal my contacts for a spammer.

Huh? How do you do that on other devices, like another computer?
In general, do you have an example of a contact manager actually talking to the internet?
Sandboxes try to work around the problem. Fixing such issues if they exist is the better approach.

I guess I'm not understanding this one either... more details maybe?

I think he's asking for some way to run new apps in some sort of isolation and block pre-defined behaviors. I think he's trying to illustrate in his contact manager example a scenario in which he downloads a 3rd party Contact Manager from somewhere and since its 3rd party and presumably closed source, he is worried that such a program might steal his data and report it back to the programmer who would then use it for nefarious purposes.

The problem with your request RNK, is that maybe in some instances a Contact Manager WANTS to get on the internet. For example, maybe you added a Skype username to a contact. The contact manager might then want to go online and get that user's avatar picture to display to on on the device.

Without taking apart the TCP packets, you won't know what its doing.

The same goes for all other resources an application might request. Memory, Storage, Camera, Mic. You can block them all with some sort of sandbox, but then you've just rendered your new app useless.