[sluckxz]

I'm using xprivacy. It is a pain in the ass but does give me the functionality you mentioned. Root required. Asks with popup on requested permission. Tracks app permission request history. Fresh installed apps restricted by default. I paid for the pro/donation version which fetches community curated restriction lists. Honestly I don't know if its worth the bother but seems like the least I can do. I do get some comfort finding many apps I install actually use less permissions than they ask for at install.