# Android permission matrix

The machine-readable source of truth is [`tool/android_permissions.json`](tool/android_permissions.json). CI tests require every permission in the main Android manifest to have one owner, feature and trigger.

Triggers have these meanings:

- `user_action`: Android permission or settings UI may be requested only after a related tap, toggle or confirmed WebView prompt.
- `feature_enabled`: background behavior may start only after the user enables the feature.
- `active_feature`: the permission is used only while the related feature is active.
- `system`: install-time capability without a runtime prompt.

| Area | Permissions | User-visible entry point |
| --- | --- | --- |
| Transport | `INTERNET`, `ACCESS_NETWORK_STATE` | Login and normal messaging |
| Updates | `REQUEST_INSTALL_PACKAGES` | Confirmed update installation |
| Camera and audio | `CAMERA`, `RECORD_AUDIO`, `MODIFY_AUDIO_SETTINGS` | Attachment camera, voice/video note, QR scanner or call |
| Location | `ACCESS_FINE_LOCATION`, `ACCESS_COARSE_LOCATION` | Location attachment; legacy BLE contact exchange |
| Bluetooth and NFC | `BLUETOOTH*`, `NFC` | Contact exchange sheet |
| Notifications | `POST_NOTIFICATIONS`, `VIBRATE`, `WAKE_LOCK` | Notification settings or active notification feature |
| Foreground services | `FOREGROUND_SERVICE*` | Enabled FKM, active call or screen sharing |
| Background startup | `RECEIVE_BOOT_COMPLETED` | Previously enabled FKM only |
| Special settings | `REQUEST_IGNORE_BATTERY_OPTIMIZATIONS`, `USE_FULL_SCREEN_INTENT` | Separate confirmation in notification settings |
| Media library | `READ_EXTERNAL_STORAGE`, `READ_MEDIA_*` | Attachment picker or explicit save action |
| Contacts | `READ_CONTACTS` | Optional phonebook-name feature |

WebView camera, microphone and location requests additionally require an HTTPS allowlisted origin and a per-request confirmation dialog.