I'm not sure if this is possible to implement, but would it be possible to add a toggle to each app configuration to either allow or disallow it using Sandboxed Google Play Services? Like the Network or Sensors permission toggle, but for Sandboxed GP?