Also highly granular app permissions. So you can turn off network access for, say, the Google Camera.