It's either that or as suggested, hard require developer validation for specific API permissions.