You could have two classes of apps - manufacturer approved ones that do the usual stuff and unapproved ones that get limited access regardless of what the user types?