Exactly — the scoped permissions are the easy part. If users can't see what they approved and undo it in two taps, the trust just isn't there. UX is where it gets won or lost.