Photo access splits into selected items versus the whole library

What it is

Photo authorization has at least two grades: selected items (what the person picked in a system picker) and full library (the app may enumerate the library, read metadata, and see photos taken later). Sending one image, changing an avatar, attaching an invoice should use selected. A local library browser, faces grouping, or whole-library backup needs full. These are different capability scopes, not two wordings of the same permission. This entry is not about whether live capture should use the system camera, and not about picking contacts.

Why it happens

A library is ordered by time and place; full access is a visual log with a trail, and it keeps seeing new shots after the grant. Selected pins the scope to the files picked this time; the app has no right to scan again. People often hear "Allow Photos" as "allow me to pick one." If the system or the product implements that sentence as full access, consented granularity is silently widened. Splitting the grades lets someone who refuses full access still send. Binding them together makes a social photo cost the whole library.

Where it stops holding

Pro culling, backup, device-to-device sync, and tools that must read all metadata are full-access tasks. Even then, offer "sync only selected albums" as a narrower grade. If selected still takes a full EXIF pack and paired live photos, say so on the picker; do not pretend a thumbnail was all that moved. Web file pickers are usually already selected-grade; a site should not also ask to walk a directory.

Applying it

• Send, comment, avatar, and receipt entries call the system photo picker and do not request full library permission.
• Hang full access only on manage / backup / browse-the-library, with a pre-prompt that existing and later items will be visible.
• If full access is already granted, Settings must offer a step-down to selected without requiring a total shutoff first.
• Verify after "send one image": system photo permission should be selected or not-determined. Rerun send on a device with full access off and selected still on; the task should complete. Check that the send-only path does not call an enumerate-the-library API.

Related

• Within the group: H4.09.1 Prefer picking individual contacts over a full address-book grant · H4.09.3 Uploading contacts to match friends must say how the server will keep them · H4.09.4 After fine-grained pickers exist, a full-access ask is harder to justify
• Adjacent: H4.08 Camera and Microphone Permission · O1.02 Data Minimization · H4.07 One-time vs Ongoing Authorization
• Search terms: photo picker · limited photos · full library access