Android 4.3 has a hidden feature! It's called "App Ops" and it lets you selectively disable some permissions for your apps. Is some misbehaving app constantly pinging your location and draining your battery in a few hours? You can fix that now.

Update! Optional permissions at install

I'm working on my full 4.3 teardown, but I just ran across this and had to add it here:

<string name="grant_confirm_question">Do you want to grant the following permissions? It will get access to:</string>

I found this in the Package Installer, so once this is fully launched, it looks like you'll be able to deny some permissions the time of installation, too.

It's not really ready yet, so Google has hidden it. It seems to work though. If you're feeling adventurous, here's what you do to try it out:

Fire up something that can launch an activity (like Nova Launcher), pick settings, and then "App Ops." You now have a shortcut.

Another Update: Someone actually made a handy app that launches the permissions manager. You can download it right here. It will only work if you have Android 4.3.

Tap the icon and you'll see something like this. There's list of all your apps and the permissions they use, categorized into 4 handy tabs. The tabs are broken down into "location," "personal," "messaging," and "device," so it's easy to see what app uses the permissions you're concerned about. On the right is a timestamp for when the app last used a permission.

Once you pick an app, you'll get a screen with easy on/off buttons for each permission. Don't want Facebook to know your location? Just hit the "off" switch. The app will still work, it just won't have any idea where you are. This screen also tells you the last time each individual permission was used.

The one problem I see (and hopefully the reason why this isn't a user-facing feature yet) is that there is no explanation for why your location is broken in Facebook. A system notification that says something like "App Ops is currently limiting this application's permission access" would probably stop some tech support nightmares.

The way this list works is actually highly annoying. Rather than just read the declared permissions in App info (above), App Ops tries to do "detection" for certain permissions.

For some permissions, the app has to make use of them before they will show up in App Ops. For instance, on the left is my permissions list when I first fired up Facebook; in the middle is the list after I told it to import contacts; on the right is the list after I posted a picture from the camera. You have to go and hunt down all the permissions and make the app use them before you are allowed to disable them. That's a lot of work. Is this list complete? Will it ever be complete? There's really no way of knowing.

That's about it for App Ops. Just please, take care when you mess with this, and keep in mind it's not ready yet, so you might run into problems. Also, even when it does work, you are messing with settings the app developer never intended for your to have control over. If you happen to horribly break something, don't blame me!

Thanks Vincent de Smet!