I'm creating a package that allows Salesforce API access via a connected app. It works great in my demo org, but our customer does not want it to have access to any data other than contacts and a new custom object we are creating. We too would prefer not to have access to anything else, just to avoid any liability.
This customer can do this by creating a custom user to be used only for this app and applying the restrictive permissions. However, it would be nice to be able to limit this with the package itself, rather than requiring manual setup of a user.
Is there any way to automatically restrict what a package has access to or does the installing admin have to handle that via user permissions?