0Pricing
Android Academy · Lesson

The Android Permission Model

Understand install-time and runtime permissions.

The Android Permission Model is a free Android Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Android Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The Permission Model

Android protects sensitive data and capabilities behind permissions. Your app must declare what it needs and, for sensitive items, ask the user at runtime.

Understanding the two categories is the foundation of getting this right.

Declaring in the Manifest

Every permission your app uses must be declared in AndroidManifest.xml with a <uses-permission> tag. This is true for both categories.

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.CAMERA" />

Normal (Install-Time) Permissions

Normal permissions pose little privacy risk. The system grants them automatically at install time. The user is never prompted.

  • INTERNET
  • ACCESS_NETWORK_STATE
  • VIBRATE

You declare them and they just work.

Dangerous (Runtime) Permissions

Dangerous permissions guard private user data or device features. The user must explicitly grant them at runtime, and can revoke them later in Settings.

  • CAMERA
  • ACCESS_FINE_LOCATION
  • READ_CONTACTS
  • RECORD_AUDIO

Permission Groups

Dangerous permissions belong to groups (e.g. Location, Contacts). The system prompt shows the user a single, friendly description of the group rather than raw permission names.

Why Runtime Permissions Exist

Before Android 6.0, users granted everything at install or not at all. Runtime permissions give users granular, revocable control, asking only when a feature is actually used.

This builds trust: users see the request in context.

Checking If Already Granted

Always check before using a protected feature. ContextCompat.checkSelfPermission returns whether the permission is currently granted.

val granted = ContextCompat.checkSelfPermission(
    context,
    Manifest.permission.CAMERA
) == PackageManager.PERMISSION_GRANTED

Special Permissions

A few capabilities are neither normal nor standard-dangerous; they are special permissions requiring the user to flip a toggle in a dedicated system Settings screen, such as "Display over other apps" or "All files access".

Permissions Can Change by API Level

The classification and behavior of permissions evolve. For example, POST_NOTIFICATIONS became a runtime permission only on Android 13. Always check the docs for the API levels you support.

The Golden Rule

Never assume you have a permission. The flow is always:

  1. Declare in the manifest
  2. Check at runtime
  3. If not granted, request it
  4. Handle grant and denial gracefully

Least Privilege

Only declare and request what you truly need. Each extra dangerous permission lowers user trust and can trigger Play Store policy review. We will return to this in the privacy lesson.

Quick Check

Test your understanding of the permission model.

Recap

You learned the Android permission model:

  • All permissions are declared in the manifest
  • Normal permissions are auto-granted at install
  • Dangerous permissions need explicit runtime consent and can be revoked
  • Always check before use; some capabilities are special permissions

Next: requesting permissions in Compose.

Frequently asked questions

Is the “The Android Permission Model” lesson free?

Yes — the full text of “The Android Permission Model” is free to read here on the web, and the Android Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Android Academy course, upgrade to CoddyKit PRO.

What will I learn in “The Android Permission Model”?

Understand install-time and runtime permissions. You practise Android Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Android Academy?

No prior experience is required. Android Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “The Android Permission Model” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Android Academy lesson?

Yes. Every Android Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. The Android Permission Model
  2. Requesting Permissions in Compose
  3. Handling Denials and Rationale
  4. Best Practices for Privacy
← Back to Android Academy