System in-use indicators and in-app permission entries do different visibility jobs

What it is

Permission visibility is two different jobs. A system in-use indicator answers "is the sensor or location on right now." An in-app permission entry answers "is this grant Allow, Deny, or Once, and where do I change it." The first is occupancy; the second is the lease. Replacing the system green dot with an in-app speck, or expecting people to walk from a status-bar dot into Settings to revoke, stacks both jobs on one control. This entry is about the split. It is not a ban on hiding the camera light, and not about whether a one-time grant should show a duration label.

Why it happens

Occupancy and lease run on different clocks. Occupancy is counted in seconds and must sit at the edge of the visual field, unswitchable by the app. A lease is counted in days and needs a findable settings row, readable copy, and a toggle that jumps. In "I'm being filmed" people need stop-now, not a hunt through Settings. In "I want location back" they need to change the grant, not to see whether a green dot is lit. One fused signal fails two ways: with no occupancy cue, collection looks off while the grant remains; with only occupancy, turning "off" looks like revoke when it only ended this session. The split maps each problem to its action.

Where it stops holding

Some platforms make the occupancy list tappable into the app's permission page—the system chaining two hops on its own surface. The app still must not drop the settings row: not every occupancy is tapped. When a watch or car screen cannot hold two UIs, keep the system occupancy indicator and put lease state in the paired phone's app Settings, with a line on the watch that management lives on the phone. On the web, occupancy is the browser's; the site's settings page owns business toggles, not a fake camera lamp.

Applying it

• System indicators own occupancy: the app does not cover them, fake them, or offer "hide the indicator but keep capturing."
• App Settings keeps a status row and a system jump for every permission already asked, even when the system occupancy cue is already loud.
• While a feature is running, occupancy (system) and mode (Once / Always) may both appear as short labels, but tapping a label should open lease state, not turn off the light.
• Verify by asking, during capture, "is it on now"—the answer should point at the system indicator. Then "how do I turn it off for good"—the path should go through the in-app status row into the system toggle. If both questions land on the same custom icon, the split failed.

Related

• Within the group: H4.10.2 When Settings revokes a permission, the app must detect it and degrade · H4.10.3 A mismatch between shown permission state and actual availability is misdiagnosed as a bug · H4.10.4 Unused permissions after first install should prompt a keep-or-drop review
• Adjacent: H4.04 Revocable Permissions · H4.08 Camera and Microphone Permission · O2.03 Sensor-Use Indicators · H4.07 One-time vs Ongoing Authorization
• Search terms: privacy indicator · in-app permission settings · grant state