(i've had to add this as a separate post because my comment was too long)

> What more would you add? The existing permissions system on the web seems to be very granular to me.

It's disjoined, inconsistent and insecure by default. If it was as robust as you make out then we wouldn't have a need for the cookie consent law nor GDPR (opinions of the EU and those respective laws aside).

I honestly don't think web can have a robust permissions system given its current architecture. I think it would need a ground up redesign - or at the very least it would need to make breaking changes. But one idea I have is where sites have to send metadata down (as part of the headers if like?) with each page stating what permissions that page requires to function. Eg: make outbound JS requests to it's own site, to other sites. To save cookies on it's own domain, or other domains. Which hardware it has access to. Whether it uses local storage. Whether it's allowed to write HTML into it's own page. etc. This will be a bit like the XML file that includes Android APK files and tells the JVM which APIs you are using (but not as shitty). So if the page doesn't declare it needs access to something in the metafile, then it simply doesn't get access to do that. That way users can see what each page is doing just be looking at the requested permissions even before any popup appears requesting access to xyz.

Further to that, you can define in the browser which permissions to allow by default - this is a little like what is available already but more granular (eg the self-modifying page example earlier). You can define those policies as "Never allow", "Request authorisation", or "Allow" and the authorisation with be on a per-domain basis (again, like some browsers already do). The benefit there is you now have all of your Javascript, cookies, etc permissions wrapped up in one centralised ACL and an easy way of seeing what each web page/application wants to do even before a request popup appears on your screen.

Further to that, some interactions (the exploitable ones) will be logged. eg calls from one domain to another. So some of the more experienced users have the ability to scan for suspicious behaviour without having to trawl through thousands of HTTP get / post requests.

I'd also like reminder prompts. eg if a service you allowed to make location requests does it frequently, I'd want a banner across the bottom of the page reminding users that this is happening frequently and that can only be mitigated by "trusting" that service with that API (an additional manual action on top of allowing it initial access to a particular browser feature).

Another cool feature would be if versioning was built into webpages. Each page would be versioned and that version number would stored with a checksum of the page. Thus if the page changes between refreshes, the browser knows and resets all the permissions on that page to the user defaults (ie any previous prompts would then have to be re-prompted again). This would cause issues for content that's dynamically generated on the server side (eg forums, API endpoints, etc) but there could be another couple of permissions there, one where the API declares itself as an API and thus you grant the Javascript permission to call an API; and another where you can define whether to ignore version changes on any particular domain.

In fact if we are doing a ground up redesign, then it would be possible to separate the textual data content from the formatting and application code in ways that HTML currently makes difficult. So you could still version and checksum the code and still have the page rendered at the server side.

It would also be nice to have some definable CPU and memory caps too - since each tab is basically now a virtual machine.

This is all pie-in-the-sky stuff and probably really badly explained too (it's late and I've never been great at explaining things at the best of times anyway). Plus a lot of it is stuff I've just thought of now as examples to your question. So I'm sure you'd find many faults with what I've posted. Thus all I ask is you respect the spirit of what I'm saying rather than taking the points literally as a written gospel I'm suggesting we implement tomorrow. There will be problems implementing that verbatim but my point is to illustrate just how little protection the web offers and how much further we need to go given its current nature is basically just allowing anyone to run any untrusted application on their local machine.