I would like to have Pixel+GrapheneOS as my new phone but everything I'm capable to find about "firewall per app" is just simple switch network/no-network (probably via kernel capabilities) then to ability filter network acces per app of style "no network / wifi only / wifi+mobile data". Some of them are even able to recognise and filter mobile data when on roaming.

But by my investigation, GrapheneOS can't do it.

What "firerall per app" on GrapheneOS do you mind in your comment?

Thanks.