Prefer the system capture UI for one-shot photos over a standing camera grant

What it is

Changing an avatar, photographing an invoice, scanning one code—people need this frame, not a standing hold on the camera. Prefer the system's capture or document-scan UI: it closes after the shot, hands back an image, and often needs no ongoing camera permission. Jumping straight to "Allow Camera" and leaving a custom preview writes a one-shot task as a standing capability. This entry is about which capture entry to use. It is not about picking an existing photo from the library (that is library granularity), and not about a video call's genuinely continuous preview.

Why it happens

A standing camera grant lets the app open the viewfinder at any later moment, including after the "set avatar" situation is over. A system picker keeps the capability inside a system process: the app receives a result file, not a sensor switch. For a one-shot task, risk shrinks from "may open the camera from now on" to "this one image." The only honest reason for a custom preview is a task that needs continuous framing (lining up a code, detecting ID edges, adjusting beautify). If none of those exist, the custom preview is branding purchased with a long-lived permission.

Where it stops holding

Live scanning, AR measuring, video calls, and continuous lighting controls need their own preview; a system picker cannot run the alignment loop. If the system picker still requests camera permission behind the scenes, do not treat Always as the success state after the shot. The web has the same split: one image should use file-pick-plus-capture, not a long getUserMedia session.

Applying it

• One-frame tasks go through the system camera or document-scan API. Product code on that path does not request a standing camera permission.
• Use a custom preview only when the task needs continuous framing, and release the session as soon as that screen is left.
• When a custom preview is rewritten back to "just one shot," delete the launch-time camera ask.
• Verify after "change avatar / photograph invoice": in system Settings, camera should still be not-determined or Once. If it is Always, the entry was wrong. Then check that no camera session remains open after leaving the capture screen.

Related

• Within the group: H4.08.1 Request camera and microphone separately; do not merge them as "media" · H4.08.2 Do not hide the in-use light or icon after the grant · H4.08.4 Silently using camera or microphone in the background is a serious trust breach
• Adjacent: H4.07 One-time vs Ongoing Authorization · H4.09 Contacts and Photos Permission · O1.02 Data Minimization
• Search terms: camera picker · one-shot capture · document scanner