Custom permissions restrict component access under defined conditions. Naming a permission does not establish the correct protection level.
Evaluation approach
Evaluate signing relationships when sharing between applications from the same developer. Test signature changes and key upgrades.
Application example
Confirm that an application signed with a different key cannot access data shared between the main enterprise app and its authorized helper.
Limits and considerations
User-granted permissions and signature-based trust are different mechanisms.
Why signing transitions need regression tests
Key upgrades and new application-family members can change access. Test periods when old and new versions coexist. Acceptance requires both authorized access and rejection of differently signed applications.
Checks and decisions
- Check protection levels
- Plan key transitions
- Test a different signer
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.