Little Snitch can do this currently, if you're looking. Outbound firewalls are somewhat annoying, though, as you have to authorize every single program at least once, which makes me think that Apple is unlikely to add one that runs by default.
Just wondering, could a trojan somehow control safari (or other approved apps) via a script, and then upload files to the hacker's server, circumventing little snitch and other outgoing firewalls?
The one thing Lion has going for it here is that apps can declare their intention to do certain things and then be prohibited from doing anything else. So, for example, a non networked app can tell the OS it has no interest in using network APIs and will then be sandboxed from them (so if its code is violated it won't be able to suddenly start phoning home). But, of course, this requires effort on developers' parts to support the feature. The key thing is that Apple's own apps are likely to use this feature.
But if you download some random piece of software and then run it and the OS says "are you sure?" and you answer yes then you're boned.
And again, if you already said "yeah" to "run this bizarro app from disreputable source", are you going to say "omfg no" when asked if it can use the network?
