Well, when you install an application it will tell you what priviliges are required for it to run, right? I am not sure how the QC is set up at Google Play so is it possible to device an application so that it utilizes a capablity it does not advertise at install time.
If the device is fully locked down you can only install applications from the store that is installed to the device.