# permission Published articles for permission. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## From Atlas experiment to Airlock: extracting agent governance into a product DevFeed: [From Atlas experiment to Airlock: extracting agent governance into a product]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:35:36Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Security](), [Artificial Intelligence](), [App](), [Linear](), [Slack]() Tags: [agent](), [ai](), [ai-agents](), [authorization](), [email](), [integrations](), [linear](), [permission](), [policy](), [product](), [security](), [slack]() ### AI overview The article explains how WorkOS's Airlock grew from the Atlas experiment into a standalone authorization product for governing AI-agent actions in company tools. A demonstration shows policies blocking emails containing financial information and requiring approval for unfamiliar distribution lists. ### Source excerpt Airlock grew out of Atlas to give IT and security teams a shared way to govern agent actions. Aaron Tainter's Agent Night demo shows how it works. ## Agent session chains that can't escalate DevFeed: [Agent session chains that can't escalate]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [API](), [API keys](), [systems]() Tags: [agent](), [api](), [auth](), [authorization](), [backend](), [multi-agent](), [multi-agent-systems](), [permission](), [server](), [systems]() ### AI overview The article explains how Agent Auth session chaining lets an agent create separately scoped child sessions for subtasks. Each child records its parent, uses its own access and single-use refresh tokens, can be revoked independently, and cannot outlive the root session. The supplied text also states that the backend creates the chain server-side using an API key. ### Source excerpt An agent can open a child session of itself for a sub-task. The chain re-derives authority at every hop and can never outlive its root. ## Run contained pen testing as chaos experiments securely DevFeed: [Run contained pen testing as chaos experiments securely]() Original publisher: [Read original article]() Author: Uma Mukkara Published: 2026-09-09T22:42:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Resilience](), [Security](), [Testing]() Tags: [chaos](), [permission](), [pipeline](), [production](), [resilience](), [security](), [testing](), [tool]() ### AI overview The article describes contained pen-testing experiments that run inside a release pipeline. Each experiment targets one service, one failure or intrusion condition, and one pipeline stage, producing an immutable audit record while avoiding broad production access. ### Source excerpt | Blog ## From Permissions to Sessions: Rethinking Location Access in Android 17 DevFeed: [From Permissions to Sessions: Rethinking Location Access in Android 17]() Original publisher: [Read original article]() Author: Nav Singh Published: 2026-09-09T01:15:51Z Content type: tutorial Language: en Sources: [ProAndroidDev - Medium]() Topics: [Android](), [Jetpack Compose](), [android-development](), [implementation](), [ui]() Tags: [android](), [android-development](), [android-permissions](), [android17](), [androiddev](), [compose](), [development](), [feature](), [how-to](), [implementation](), [jetpack-compose](), [permission]() ### AI overview A tutorial on implementing Android 17's system-rendered Location Button in Jetpack Compose. The button uses the USE_LOCATION_BUTTON permission and grants precise location for the current session, with local rendering fallback on older Android versions or when remote rendering fails. ### Source excerpt Image generated using Gemini In this article, we will learn how to implement the new 📍Location button introduced in Android 17 in Jetpack Compose-based Android applications. Android 17 adds a system-rendered 📍Location Button that we can drop into the layout via a Jetpack library, and tapping it gives the app precise location for that session only, gated by a new USE_LOCATION_BUTTON permission. What the feature is Android now exposes a system-owned, standard location button that we can embed in our UI instead of designing a custom control. When the user taps it, the system handles the permission flow, then grants the app precise location for the current session only, rather than long-lived access. How it changes permissions Instead of immediately requesting ACCESS_FINE_LOCATION (and maybe ACCESS_COARSE_LOCATION) at runtime, we declare the new USE_LOCATION_BUTTON permission to host the button. Developer benefits Less custom permission boilerplate: We lean on system UX and the Jetpack library for the hardest parts of location consent. [versions] locationbuttonCompose = "1.0.0-alpha01" [libraries] androidx-locationbutton-compose = { group = "androidx.core.locationbutton", name = "locationbutton-compose", version.ref = "locationbuttonCompose" } Higher trust and clarity for users: the control looks and behaves consistently across apps, and session-only precise access is easier to understand than broader access. Implementation As we all know, Android development is now Compose-first, so we will implement it using the LocationButton composable provided by th ## Pick One Contact Without Asking for the Address Book DevFeed: [Pick One Contact Without Asking for the Address Book]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-09-09T00:00:00Z Content type: article Language: en Sources: [CodeName One]() Topics: [API](), [Android](), [iOS](), [Code](), [App]() Tags: [android](), [api](), [code](), [contactpicker](), [ios](), [native](), [permission](), [privacy]() ### AI overview ContactPicker lets Codename One applications request selected contact fields through a system-owned picker without broad address-book permission. The article describes platform differences, limited fallback behavior, manual-entry handling, and more precise permission detection. ### Source excerpt ContactPicker lets a Codename One application request selected contact fields through the system picker without broad address-book permission. ## Fill an SMS Verification Code Without Reading the Inbox DevFeed: [Fill an SMS Verification Code Without Reading the Inbox]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-09-07T00:00:00Z Content type: tutorial Language: en Sources: [CodeName One]() Topics: [Android](), [iOS](), [Web](), [Security](), [API](), [Accessibility]() Tags: [accessibility](), [android](), [api](), [asynchronous](), [ios](), [otp](), [permission](), [security]() ### AI overview Codename One adds one-time-code autofill, a country-aware phone-number field, and a verification component for iOS, Android, and the browser without requesting access to the rest of the SMS inbox. The article explains the asynchronous verification flow, server-side security responsibilities, and a single-editor design that improves typing, pasting, accessibility, and autofill. ### Source excerpt Codename One adds phone-number and OTP components plus one-time-code autofill on iOS, Android, and the web without requesting permission to read SMS messages. ## Dealing with sensitive permissions on Android DevFeed: [Dealing with sensitive permissions on Android]() Original publisher: [Read original article]() Author: Thomas Künneth Published: 2026-09-05T09:22:30Z Content type: opinion Language: en Sources: [Thomas Künneth]() Topics: [Android](), [Google Play](), [Authorization](), [Google]() Tags: [android](), [androiddev](), [app](), [coding](), [community](), [development](), [engineering](), [google-play](), [inclusive](), [permission](), [policy](), [privacy](), [software]() ### AI overview This article explains how Android and Google Play treat READ_CALL_LOG as a sensitive permission. It describes how Google Play restrictions affected TKWeek's distribution and led the author to remove call-log access from Play builds while restoring the feature in builds distributed through F-Droid and Obtainium. ### Source excerpt Right now the developer community seems fascinated (if not outright obsessed) with agentic coding. That wave is real, and it will heavily impact how we build software. But let's not forget there are other topics worth attention. Here, the focus is something less fashionable: sensitive permissions on Android. After shipping TKWeek updates outside Google Play and answering the inevitable Why isn't this on the Play Store? with a blunt Sensitive permissions, it is fair to ask whether that topic still matters in 2026. I can answer that from shipping one app for a long time. I started working on TKWeek back in 2010. Some time later I added a module called My day that shows important information for a particular day, including missed phone calls. READ_CALL_LOG is a dangerous permission since API level 23, so users who do not want to allow the app to read those details have a secure, reliable safety hatch. Still, after a late-2018 announcement, by 2019 Google Play was enforcing READ_CALL_LOG under its high-risk / sensitive rules. Now, what does that store layer mean anyway? Dangerous on the device, sensitive in the store On the platform side, Android already classifies quite a few permissions as dangerous: they guard private user data, and starting with API 23 the user must grant them at runtime. READ_CALL_LOG is in that bucket (Manifest.permission.READ_CALL_LOG). Google Play's extra layer sits on top of that. In Play docs the umbrella is high-risk or sensitive permissions; Call Log and SMS are restricted permission groups. Either way, it is store policy, not just OS protection. For Call Log and SMS, only narrow use cases are allowed (typically default Phone, SMS, or Assistant handlers, plus a short list of exceptions), and you must declare them in Play Console or remove them from the manifest. See Google's Permissions and APIs that Access Sensitive Information and Use of SMS or Call Log permission groups. Back in 2021 that policy stopped being theoretical. Showing missed c ## Your AI agent shouldn't inherit your admin's permissions DevFeed: [Your AI agent shouldn't inherit your admin's permissions]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-03T00:00:00Z Content type: release Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [AI Agent](), [API keys](), [API]() Tags: [agent](), [audit](), [auth](), [permission]() ### AI overview The article explains how WorkOS Agent Auth limits delegated AI agent sessions using both the invoking user's permissions and an agent definition's permission ceiling. It describes delegated and autonomous agents, along with reusable definitions, allowed invokers, and session lifetimes. ### Source excerpt Delegated agent sessions are now capped by the user and the agent definition at once, which closes a gap we couldn't close a few months ago. ## Your agent's permission model stops at your home folder DevFeed: [Your agent's permission model stops at your home folder]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-02T00:00:00Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [AI-assisted coding](), [coding](), [API](), [Command-line interface]() Tags: [agent](), [agents](), [api](), [coding-agents](), [developer](), [permission](), [yolo]() ### AI overview This opinion article argues that coding-agent permission systems primarily protect local files and shell actions, while providing little business-aware control over API operations such as CRM changes. It examines approval fatigue, automatic approval modes, and the need for permission models that understand business impact. ### Source excerpt Coding agents were built to guard a filesystem. The blast radius that matters now is in your CRM. ## MCP: Scope step-up is not authentication step-up DevFeed: [MCP: Scope step-up is not authentication step-up]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-01T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [Authentication](), [Authorization](), [MCP Server]() Tags: [authentication](), [authorization](), [browser](), [compliance](), [delivery](), [mcp](), [mcp-server](), [model-context-protocol](), [permission](), [protocol](), [scope](), [token]() ### AI overview The article distinguishes MCP scope step-up from authentication step-up. MCP's current authorization flow addresses insufficient permission by obtaining broader scopes, but it does not standardize verifying whether a human recently authenticated or is still present. It recommends binding out-of-band approval to the user and exact operation until this changes. ### Source excerpt MCP standardized how an agent asks for more permission. It has no vocabulary yet for asking whether the human behind the token is still there. ## Curating queues beats approving actions DevFeed: [Curating queues beats approving actions]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-27T14:28:13Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Access Control](), [Security]() Tags: [access-control](), [agent](), [permission](), [queue](), [security]() ### AI overview This opinion article argues that continuous agents make one-action-at-a-time permission prompts impractical. For reversible work, it proposes generating a surplus of candidates, placing them in a queue, and having a human select which work to pursue. ### Source excerpt The permission prompt breaks down once an agent works continuously. What replaces it is curation: a surplus of candidates, a queue, and a human who picks. ## Designing the connect flow your users actually see DevFeed: [Designing the connect flow your users actually see]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-27T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [ui](), [Google](), [Microsoft]() Tags: [google](), [how-to](), [integrations](), [microsoft](), [permission](), [trust](), [ui](), [verification]() ### AI overview This article explains how to design the user-facing OAuth connection flow, including provider consent screens, branding verification, partial permission grants, administrative approval, and connection health after authorization. ### Source excerpt What the consent screen shows, why partial grants are normal, and how to model connection health. ## Security Baked Into the JVM: two Subjects, one call DevFeed: [Security Baked Into the JVM: two Subjects, one call]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-08-09T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [SPIFFE](), [SPIRE]() Tags: [certificates](), [dirtychai](), [java](), [jgdms](), [jini](), [jvm](), [jwt](), [microservices](), [oidc](), [permission](), [process](), [security](), [spiffe](), [spire](), [technical]() ### AI overview This article examines identity and security in the JVM through DirtyChai. It describes separate process and user identities, including SPIFFE workload credentials delivered through SPIRE and JWT/OIDC-based user identity, and explains how these identities coexist across request dispatch and privilege boundaries. ### Source excerpt The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai answers differently. ## Running YOLO-Mode Coding Agents in a Sandbox for Infrastructure Work DevFeed: [Running YOLO-Mode Coding Agents in a Sandbox for Infrastructure Work]() Original publisher: [Read original article]() Author: Engin Diri Published: 2026-08-04T00:00:00Z Content type: opinion Language: en Sources: [Pulumi]() Topics: [Claude Code](), [Security](), [coding](), [Claude](), [Filesystems](), [codex](), [cursor](), [Amazon Web Services]() Tags: [agent](), [ai](), [ai-agents](), [autonomous](), [aws](), [best-practices](), [claude](), [claude-code](), [codex](), [coding](), [cursor](), [docker](), [files](), [infrastructure](), [infrastructure-as-code](), [permission](), [sandbox](), [security]() ### AI overview This opinion article argues that coding agents should retain autonomous YOLO-mode operation inside a sandbox rather than rely on repeated command approvals. It discusses risks to local files, AWS credentials, Kubernetes configurations, and Pulumi access tokens, and presents sandboxing as a way to limit the blast radius during infrastructure work. ### Source excerpt Claude Code calls the flag --dangerously-skip-permissions, and the community long ago renamed it YOLO mode. It lets your coding agent run any command it wants without ever asking for permission. Every agent has some version of it, Codex and Cursor included, and if you use these tools seriously, you are probably running one of them every day. I am. YOLO mode is also what makes a coding agent worth having. An agent that stops for approval before every command is not autonomous; it's a slow pair programmer. But you cannot let it run wild on your machine without real guardrails either. You have heard the horror stories: wiped databases, deleted home directories, vanished git history. The odds on any given day are low, and it's tempting to conclude it will never happen to you. It only has to happen once. My version of this problem is worse than most, because the code in my working directory is infrastructure code. My laptop holds more than source files. It holds AWS credentials, kubeconfigs that point at real clusters, and Pulumi access tokens. This post walks through what an unsandboxed agent can actually do, why prompt guardrails fail exactly when you need them, and how a sandbox lets you keep full YOLO-mode autonomy anyway. Then I will show you the kit I built for doing infrastructure work this way. Approving every command is not a security model Let me get one thing out of the way first: the answer is not to turn YOLO mode off. A real working session involves hundreds of commands, and nobody reviews the hundredth npm install any better than the first. You are not evaluating at that point; you are pressing enter. Approval fatigue turns the permission prompt into a formality while destroying the one thing you wanted from the agent, which is that it works while you do something else. The goal instead is to run YOLO mode somewhere it cannot hurt you. That somewhere is a sandbox: an isolated environment where the agent has full autonomy and your machine is no longer part ## Testing an Agent Harness Without Ever Calling the Model DevFeed: [Testing an Agent Harness Without Ever Calling the Model]() Original publisher: [Read original article]() Author: Philipp Lehmann (philipp.lehmann@gruppe.ai) Published: 2026-07-31T07:00:00Z Content type: tutorial Language: en Sources: [Philipp Lehmann]() Topics: [Testing](), [Agent Harness](), [Pytest](), [Unit testing](), [coding]() Tags: [agent](), [agent-harness](), [agents](), [api](), [network](), [permission](), [pytest](), [python](), [recording](), [testing](), [unit-testing]() ### AI overview This tutorial explains how to unit test a coding agent's tool-call permission layer without calling a model. It recommends separating the decision function from model responses, using recorded real-request fixtures, and keeping the policy module independent of any LLM SDK. ### Source excerpt Unit testing a coding agent's tool-call permission layer with pytest and recorded fixtures: allow, deny or ask decisions with no model or API key. ## Self-service peering with a PeeringDB login DevFeed: [Self-service peering with a PeeringDB login]() Original publisher: [Read original article]() Author: Bastiaan Brink Published: 2026-07-27T00:00:00Z Content type: opinion Language: en Sources: [AS215248 - Notes]() Topics: [Networks](), [OAuth](), [Server]() Tags: [automation](), [bgp](), [dashboard](), [ipv4](), [ipv6](), [ixp](), [login](), [mail](), [networks](), [oauth](), [peering](), [permission](), [request](), [self-service]() ### AI overview The article describes a self-service peering portal that uses PeeringDB OAuth to authenticate users, verify ASN update rights, and offer exchanges where both networks are present. Requests create disabled sessions for manual approval, with inherited filtering and validation policies, notifications, and approval-based removal. ### Source excerpt Peering requests used to be mail ping-pong. Now you log in with PeeringDB on the peering page, pick an exchange, and the session is waiting for my approval. ## Bluetooth Support Across Every Codename One Target DevFeed: [Bluetooth Support Across Every Codename One Target]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-07-26T00:00:00Z Content type: article Language: en Sources: [CodeName One]() Topics: [Bluetooth](), [API](), [simulator](), [Web](), [JavaScript]() Tags: [api](), [ble](), [bluetooth](), [browser](), [chrome](), [core](), [desktop](), [hardware](), [javascript](), [permission](), [platform](), [protocol](), [simulator](), [tests](), [web]() ### AI overview Codename One's core Bluetooth API adds cross-target support for BLE, GATT, L2CAP, classic RFCOMM, Web Bluetooth, and a scriptable simulator. The API exposes platform capabilities and limits, while the implementation handles queued GATT operations and callback timeouts. ### Source excerpt The core Bluetooth API covers BLE, GATT, L2CAP, classic RFCOMM, Web Bluetooth, and a scriptable simulator while exposing each platform's limits. ## AI Coding Tip 028 - Build a Company Brain DevFeed: [AI Coding Tip 028 - Build a Company Brain]() Original publisher: [Read original article]() Author: Maxi Contieri Published: 2026-07-19T03:03:15Z Content type: tutorial Language: en Sources: [Maximiliano Contieri - Software Design]() Topics: [MCP Server](), [Model Context Protocol](), [Software as a service](), [Access Control](), [Documentation]() Tags: [documentation](), [integration](), [integrations](), [mcp](), [mcp-server](), [permission](), [technical]() ### AI overview This tutorial proposes connecting a company's fragmented knowledge systems to AI through MCP servers and a defined skill. It emphasizes source citations, freshness checks, explicit tool boundaries, and preserving requester-specific access control. ### Source excerpt TL;DR: Wire a skill into your company's live systems so every answer carries a source and a freshness check. Common Mistake ❌ As a single contributor, you can build a personal Second Brain, and it wo ## Why AI Agents Need Dedicated Identity and Access Controls DevFeed: [Why AI Agents Need Dedicated Identity and Access Controls]() Original publisher: [Read original article]() Author: Quentin Packard Published: 2026-07-17T00:00:00Z Content type: opinion Language: en Sources: [Cockroach Labs]() Topics: [AI Agent](), [identity and access management](), [Security](), [Authorization](), [audit trail]() Tags: [ai-agent](), [apis](), [audit-trail](), [identity-and-access-management](), [permission](), [security]() ### AI overview The article argues that production AI agents need dedicated identities and access controls because shared service accounts, broad permissions, and incomplete audit trails make it difficult to determine what agents accessed and why. Traditional IAM was designed around human actors and does not fully address autonomous software processes that act rapidly, access many records, call external APIs, or delegate work to other agents. ### Source excerpt The agent your team just shipped to external users has the ability to read customer records, execute transactions, and call external APIs. ## How Discord Fans Out One Message to a Million Users DevFeed: [How Discord Fans Out One Message to a Million Users]() Original publisher: [Read original article]() Author: Nikki Siapno Published: 2026-07-07T13:22:26Z Content type: article Language: en Sources: [Level Up Coding System Design Newsletter]() Topics: [Discord](), [Publish-subscribe pattern](), [real-time](), [WebSocket](), [Back end](), [Processes](), [Authorization]() Tags: [backend](), [case-study](), [channel](), [discord](), [engineering](), [permission](), [real-time](), [scale](), [server](), [websocket]() ### AI overview This case study explains how Discord fans out a single message to many online users. It describes a real-time backend built around pub/sub, guild routing processes, permission checks, session processes, and WebSocket delivery. ### Source excerpt A case study in fanout, bottlenecks, and the engineering decisions behind Discord's scale. ## Permissionless Ownership DevFeed: [Permissionless Ownership]() Original publisher: [Read original article]() Author: Nicolás Vázquez Published: 2026-06-16T00:00:00Z Content type: opinion Language: en Sources: [Webflow Blog]() Topics: [Learning](), [Process]() Tags: [context](), [deferred](), [development](), [permission](), [work]() ### AI overview A reflection on permissionless ownership: noticing problems, raising them with context and judgment, and helping move work forward before receiving a formal assignment or permission. ### Source excerpt A reflection on raising your hand, making invisible work visible, and taking responsibility before permission arrives. ## Build, Configure, or Use As-Is: The Agentic Harness DevFeed: [Build, Configure, or Use As-Is: The Agentic Harness]() Original publisher: [Read original article]() Author: Paul Iusztin Published: 2026-06-09T05:00:28Z Content type: tutorial Language: en Sources: [Decoding ML]() Topics: [Tool](), [AI Engineering](), [codex](), [Claude Code](), [Pydantic](), [TypeScript]() Tags: [agentic](), [agents](), [ai](), [ai-engineering](), [architecture](), [article](), [building](), [memory](), [permission](), [sandbox](), [sandboxes](), [tools]() ### AI overview This article explains the shared system design of agentic harnesses, covering tools, agent catalogs, subagents, skills, memory, sandboxes, and permissions. It argues that these harness components are increasingly standardized, while the main differentiation lies in the context and business layers built on top. ### Source excerpt A component-by-component teardown of an agentic harness, from tools and skills to memory, sandbox, and permissions. ## Background Work, Push Topics, And Richer Notifications DevFeed: [Background Work, Push Topics, And Richer Notifications]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-06-09T00:00:00Z Content type: tutorial Language: en Sources: [CodeName One]() Topics: [Mobile](), [Development](), [Android](), [iOS]() Tags: [android](), [background-work](), [development](), [ios](), [mobile-development](), [network](), [notifications](), [permission]() ### AI overview This article describes Codename One updates for constraint-based background work, foreground services, push topic subscriptions, shared-content handling, richer local notifications, and simulator support across Android and iOS. ### Source excerpt Constraint-based background work, foreground services, push topic subscriptions, shared-content handling, and a much richer local notification API, all with full simulator support. ## Implement Android 17's Contact Picker DevFeed: [Implement Android 17's Contact Picker]() Original publisher: [Read original article]() Author: Nav Singh Published: 2026-06-07T19:28:49Z Content type: tutorial Language: en Sources: [Stories by Nav Singh 🇨🇦 on Medium]() Topics: [Android](), [implementation]() Tags: [android](), [android17](), [androidappdevelopment-usa](), [androiddev](), [contactpicker](), [implementation](), [permission](), [privacy]() ### AI overview A tutorial on implementing Android 17's Contact Picker as a privacy-preserving alternative to READ_CONTACTS. It covers requesting contact data fields, launching the picker, handling result URIs, multi-selection, and compatibility behavior. ### Source excerpt Image generated using Perplexity In this article, we will learn how to implement the new Contact Picker introduced in Android17. Contact picker | Android Developers Contact picker -- Android17 It is a standardized, browsable interface for sharing contacts. A privacy-preserving alternative to the READ_CONTACTS permission, the picker runs on Android 17 and higher. 🪦 READ_CONTACTS Permission 🪦 It grants apps full, persistent access to all contact data -- names, phone numbers, emails, etc -- after a one-time user approval (runtime permission). Protection level: dangerous ⛔ Apps specify which data fields they need, such as phone numbers or email addresses, and users select specific contacts to share. With built-in search, profile switching, and multi-selection capabilities, the app reads only the selected data, ensuring granular control. Implementation Intent Action: ACTION_PICK_CONTACTS We will be able to specify multiple data fields our app will need at once. We do this using Intent.EXTRA_REQUESTED_DATA_FIELDS, passing an ArrayList of MIME types defined in ContactsContract.CommonDataKinds. MIME Types: //... ContactsContract.CommonDataKinds.Phone.CONTENT_ITEM_TYPE ContactsContract.CommonDataKinds.Email.CONTENT_ITEM_TYPE //...Define the ActivityResultLauncherval contactPickerLauncher = rememberLauncherForActivityResult( contract = ActivityResultContracts.StartActivityForResult() ) { result -> if (result.resultCode == Activity.RESULT_OK) { val uri = result.data?.data ?: return@rememberLauncherForActivityResult // Process the result URI.... processCPResultUri(uri, context) } }Launch the ContactPicker 📲 Define the intent val requestedFields = arrayListOf( ContactsContract.CommonDataKinds.Phone.CONTENT_ITEM_TYPE ) // Set up the intent val pickContactIntent = Intent(ContactsPickerSessionContract.ACTION_PICK_CONTACTS).apply { // Enable multi-select - true/false putExtra(Intent.EXTRA_ALLOW_MULTIPLE, true) // Set limit of selectable contacts putExtra(EXTRA_PICK_CONTACTS_SE [Next page]()