Permission refusal requires both a security decision and a usable product flow. Refusal alone is not an attack signal.
Evaluation approach
Request necessary permissions when relevant. Handle refusal, later revocation and limited access as distinct states.
Application example
Without camera permission, document scanning may offer file selection instead. Do not request unrelated access for sensitive data.
Limits and considerations
Closing the entire app can be disproportionate when only one feature needs permission.
What if access is removed later?
Test more than first-install refusal. Users may change settings while the application is open. Stop affected work safely, discard stale permission assumptions and preserve progress where possible.
Checks and decisions
- Explain the need
- Offer alternatives
- Test later revocation
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.