A comment on yesterday's post pointed at something I'd been treating as solved when it wasn't. I'd separated two things correctly — confirming an action, and disclosing what the app is allowed to do overall — but I was still planning to build the authority disclosure as a static list. "Can read calendar." "Can send SMS." Read once, forgotten immediately, and disconnected from whatever's happening on the confirmation screen five taps later.
The fix suggested was simple to say and harder to actually do: don't restate permission in prose, cite the exact grant an action consumes.
What changes
Right now my mental model of a confirmation screen looks like: show the action, show the parameters, get a yes. The authority disclosure sits somewhere else entirely, unlinked. If I add a new capability to the app later, that disclosure screen might silently start covering more than what the user actually saw when they granted it, or it just goes stale and nobody notices.
Tying each confirmation to a specific grant ID instead of a general permission bucket changes that. "Send this text" wouldn't just show the recipient and message — it would cite exactly which grant authorized it: which account, what scope, when it was given, when it expires. The action and the authority stop being two separate systems that can silently drift apart, and become one traceable chain: this confirmation, that grant, this scope.
Where it gets hard
The honest problem is granularity versus legibility. A grant precise enough to be meaningful — account, data class, purpose, expiry — is also precise enough to be unreadable in the two seconds someone actually spends looking at a confirmation dialog. "Can read calendar" is vague but scannable. "Grant #4471: read events on calendar_id=primary, scope=busy/free only, granted 2026-09-10, expires in 30 days" is precise but nobody's going to read that before tapping confirm.
I don't have the right answer yet. My current instinct is a two-layer version: a short human-readable line at the front ("using your calendar access from Sept 10"), with the full grant details one tap away for anyone who actually wants to audit it. That keeps the fast path fast and the honest path available, instead of forcing everyone through the honest path every single time.
What I'm building next
Deriving the authority surface from actual live grants instead of a static permissions list, and rewriting each action confirmation to cite the grant it's using rather than describing the action in isolation. This is a bigger change than I expected going in — it touches almost every confirmation screen in the app, not just the authority disclosure I thought I was adding.
Building in public, one wrong assumption at a time.
Top comments (0)