This is a crucial step for safeguarding privacy/security if OAuth is to become more prevalent.

Any app may request any number of permissions from me; but I as a user should be able to choose what permissions it gets. I would take this one step further and allow the user to retroactively withdraw permissions (OAuth already allows for asking the user for additional permissions).