Files and Media Permission: Choose the Smallest Android Access Model

Choose by task, not by settings label

The photo picker and storage overview offer narrower alternatives to blanket access.

Support limited access

On supported Android versions, users can grant selected media rather than the whole collection. Code should not interpret an incomplete query result as data loss or demand unrestricted access merely to continue.

Keep the UI aligned with the granted scope. Offer a way to select additional items when the feature needs them, and refresh access state when returning to the app.

Work with URIs safely

Use the returned URI and its granted access, not a guessed file path. Check MIME type and content where appropriate, bound memory usage and handle canceled selection. If the app needs long-lived access, follow the provider and API's documented persistable-grant behavior rather than assuming every URI lasts forever.

Keep permissions version-aware

Granular media permissions apply differently from legacy external-storage declarations. A copied manifest containing every old and new permission can over-request access without fixing the actual code path.

Document the supported API ranges and test each meaningful branch, including denial and revocation.

Review the release with APKLint

APKLint can help identify broad storage or media declarations in the merged manifest. It cannot tell whether a selected URI is still readable or whether the gallery UI handles partial access correctly. Those checks belong in the feature's runtime tests, including large files, remote providers and a user canceling the picker.