Lizard
So am I right in saying that when you first enable them, no access is granted to anything until you specifically choose a contact / file / folder that you want the app to have access to?
That seems to be the case. I have some apps that ask for access to files as a requirement to function, but I don't want/need to give that app so much access to my data.
In cases where I need the app to pass the requirement but I don't want to give any data to the app, I just turn on contact/storage scope and don't actually add any file/directory. The app thinks it has the permissions and passes the requirement, but in actuality, it doesn't have any access to anything.
In others where I want the app to access only specific files/directories, I turn on contact/storage scope and add only the file/directory I want to give access to. An example is OneDrive that I use for cloud-based photo sync, and it only has access to internal/DCIM
and internal/Pictures/Screenshots
folders and nothing else.