- Outcome
- Defensible, least-privilege requests
- Store lens
- Chrome and Microsoft Edge
- Reading time
- 10 minutes
Start from features, not manifest keys
List user-visible features, their trigger, required browser capability, affected data, and whether access can wait until a user gesture. Then map that inventory to manifest permissions.
A vague statement such as 'needed for functionality' does not explain scope. Describe what breaks without the permission and why a narrower API or host is insufficient.
Separate API and host access
API permissions unlock browser capabilities. Host permissions grant access to matching origins and can trigger strong install warnings. Review them independently.
The tabs permission protects sensitive Tab fields; it is not required for every use of the tabs API. activeTab may cover a temporary, user-invoked interaction, while optional permissions can defer access until the feature is used.
Synthetic example
Synthetic justification
Permission: activeTab
Trigger: User clicks "Summarize this page"
Use: Read the currently active page once
Narrower option considered: No persistent host access requested
Audit broad patterns
Patterns such as <all_urls>, http://*/*, and https://*/* deserve heightened review. Identify the precise sites the product supports and whether users can choose additional origins.
If broad access is essential, make the user benefit visible and align the listing, disclosure, privacy answers, and actual use. Do not claim least privilege solely because a feature is convenient.
Keep the inventory alive
Add permission review to every release. Remove legacy keys, retest denied and revoked states, and update reviewer notes when scope changes.
A scanner can flag broad declarations and mismatches, but it cannot know the real product purpose or guarantee a store's conclusion.
Official sources
- Chrome declare permissions
- Chrome tabs API permission guidance
- Microsoft Edge extension developer policies
Sources and guidance were human-reviewed on . Store forms and policies can change; verify them again at submission time.