|LBE Privacy Guard, |
screenshot via Appbrain
Basically, the app can tell which app is accessing what, and intercepts the call. For example, "Expenses Manager" intercepts stuff that costs money, such as sending SMS, calling phone numbers, and so on. When an app does that, you have to specifically allow the app to do so (similar to the way "SuperUser" whitelists an app) else the request is denied by default in 10 seconds.
The various "managers" let you control which apps have access to which permissions. The Security Log shows you which apps accessed what permission.
This app controls app permissions in real-time, in case you did not see all the permissions it needs when it installed. It gets a little annoying if you have a lot of apps to approve, but it does seem to work. Definitely give it a try.