Xposed Framework + XPrivacy. It breaks out ALL permissions under the main groups and each is selectable per app. In most cases, denying permission will provide fake / empty data so that app functionality is maintained. It lists ALL permissions and marks the app's requested ones so you know what it wants to use.
Best yet, it has a sort of permissions tripwire - a usage log shows you when an app has tried to use a blocked permission. In very rare cases, I've seen apps call permissions they didn't explicitly request up front.
Pretty much every app on my phone (and I don't install many) is denied accounts, contacts, location, sensors, phone ident, and web access. If an app force-closes under this template, I check the usage log and decide if I want to allow the failed permissions until the app works. I can either groan and take it or uninstall and look for a better behaved alternative.