Permissions
Choose a file in the system picker and the app receives that file. It does not receive the folder around it. Drag a note into another app and that note crosses the boundary because you moved it there. Most access follows a concrete action instead of interrupting it with a prompt.
Permissions answer three questions: Who? What can they do? How long?
Who
The subject is a person, agent or app. Each grant names one. A broad role can collect several grants for a team, but the effective access remains inspectable per collaborator.
What they can do
The scope names both an item and an action: Edit release-outline.odt, Read Planning, Use the microphone, Reach code.podesta.ai. “File access” and “Full access” are avoided when the desktop can say what they actually include.
The smallest private unit in the workspace filesystem is a file. Sharing half of one document requires splitting that private part into a separate file; encryption cannot honestly hide half of a document every collaborator must merge.
An app’s signed package lists the maximum capabilities it can ask for. Installing or updating the app grants none of them. A runtime grant narrows that maximum and never expands it silently.
How long
Permission choices name their real lifetime:
- Allow once completes the immediate action and expires.
- While open ends when the app or activity closes.
- Until logout ends with the desktop login session.
- Until revoked remains until an authorised person removes it.
- Deny grants nothing.
The prompt shows only durations the capability actually supports.
When the desktop asks
Opening a file, dropping an item and pasting already express intent, so they need no second question. Camera, microphone, location, screen capture, background work, open-ended network access and broad collections deserve an explicit choice.
Saying no is cheap. The app receives Not available, just as it does on a computer without that device or service, and keeps the parts that do not need it useful.
Review and stop access
Workspace settings lists standing grants under Who, What they can do and How long, with Remove permission beside each one. One-time use appears in history rather than pretending to be a standing grant.
Continuous access—microphone capture, following or remote input—stays visibly named while active. Select the name to see who has access and choose Stop now. There is no decorative green dot asking you to remember what it means.
Revoking access stops new actions. It cannot remove information someone already received while authorised, and the confirmation says so.