Verified local facts
Operate a permission-surface register whose state transitions remain reproducible without exposing device or applicant information.
Evidence and limitations
Each symbolic capability row links privately to a captured request, authenticated support response and device-state observation.
Questions to ask before signing
A broad prompt can combine unrelated capabilities, obscure a later state change or invite disclosure of authentication secrets.
Decision checklist
Freeze the request, classify each capability, seek minimum-function clarification and block any secret, unexplained purpose or unauthenticated route.
Evidence reviewed
informational: resolve control app permissions during a Malawi personal loan enquiry for a Malawi reader without inventing price, access, availability or approval.
Decision checklist
article article 4 3 Malawi decision path: Freeze app identity and the presented request -> Open one row per device capability -> Record purpose, trigger and timing
Freeze app identity and the presented request
Record the app name, version, distribution location, developer label, presented screen and enquiry reference privately before granting anything. Reach provider support through contact details obtained independently rather than a link inside the prompt. Credizen does not receive screenshots, identifiers or device details; keep them private. A familiar brand or polished store listing does not establish the app's identity for this personal loan enquiry. Mark every presented field observed, not verified. If the distribution source, provider relationship or current version cannot be authenticated, stop and label the whole register blocked. Preserve later changes as new observations instead of overwriting the initial request.
Open one row per device capability
Create separate symbolic rows for camera, microphone, location, contacts, files, notifications or any other capability actually requested; the guide does not prescribe which capabilities should appear. Keep captured data and personal values private. Record whether the capability is requested, granted, denied, unavailable or unknown. Do not infer safety or necessity from the operating-system category. A combined prompt must be decomposed so an explained capability cannot lend legitimacy to an unexplained one. To review data access requested by a Malawi lending app, compare every row with its stated function and authenticated support response rather than a universal permission checklist.
Record purpose, trigger and timing
For each capability, record the provider-stated purpose, the user action said to trigger it, whether the prompt appears before or after that action, and the current state. Preserve the exact private wording and checked date. A purpose such as verification or service operation is still only a claim until the authenticated provider explains it. Do not infer legal permission, proportionality or technical necessity. If the capability appears at a different step than described, open a discrepancy. Unknown purpose, unexpected timing or unmatched trigger blocks the row and should not be solved by granting access merely to see what happens.
Quarantine credentials and authentication codes
Passwords, one-time codes, recovery secrets, unlock patterns and account credentials are never ordinary app-permission evidence. Do not enter them into a support conversation, public worksheet or Credizen. If a prompt or person requests a secret outside the reader's independently authenticated login flow, stop and verify through a clean provider channel. To protect authentication codes in digital borrowing Malawi readers should preserve the incident privately without copying the code itself. Record only that a secret request occurred, its channel and verification state. An unexplained request blocks the app route and may require provider-first reporting through authenticated contact.
Ask for a minimum-function alternative
Through authenticated provider support, ask which feature requires the capability, whether the enquiry can continue with the capability denied, and which alternative channel or manual step is officially supported. Preserve the response privately. This is a functionality question, not a declaration that either option is safer or legally required. Do not install another app or transmit records merely because an alternative was mentioned. If support cannot identify the feature or provides a new unverified link, keep the row conditional or blocked. A supported alternative reduces the permission surface for this task but is not evidence of app integrity and does not predict a personal loan outcome.
Track permission transitions as immutable events
Append state events: requested, granted, denied, revoked, requested again, purpose changed or unknown. Record event time and private evidence owner without publishing device data. Revocation does not prove previously accessed data was deleted, while denial does not prove no other channel received information. Do not erase the earlier state when a prompt changes. The register's distinctive output is a transition chain that shows which capability changed and why. A change without an authenticated explanation reopens that row. This event discipline separates permission control from assumptions about privacy, security or provider behaviour. Keep the event order intact for later provider questions.
Keep transaction context outside permission legitimacy
Malawi kwacha (MWK) may appear in the reader's written personal loan or payment record, but it has no role in authenticating an app, distribution source or capability request. Keep every amount and account detail outside the register. Do not grant access because a prompt displays a familiar currency, transaction or applicant fact. Where the app's displayed transaction context conflicts with the reader's current written material, record a private discrepancy and contact the provider through a clean route. Currency evidence and permission purpose are separate branches; neither can validate the other. Record who owns the supporting private record and its date.
Preserve misuse concerns and complaint evidence
If the reader suspects unauthorised access, purpose drift or a misleading prompt, preserve the register, provider questions and responses privately. Do not collect technical evidence by granting more access. Use the authenticated provider complaint route first. The checked Reserve Bank of Malawi consumer page describes provider-first complaint handling, internal appeal and a possible later Registrar route; it does not establish a privacy breach or promise a result. Keep acknowledgements distinct from substantive responses. An unverified complaint route, missing receipt or unexplained capability state blocks the affected casefile branch. Link each later response to the capability row that raised concern.
Close with deletion and reopening triggers
Bounded means the app and support route are authenticated, each requested capability has a documented purpose and trigger, secret requests are absent, and transitions are reproducible. Conditional means a named support answer or state confirmation remains open. Blocked means identity, purpose, capability, secret handling or complaint route cannot be verified. None of these verdicts certifies privacy, security, legality, eligibility or approval. Record when private working copies should be removed under the reader's secure practice. Reopen the register for a new version, added capability, changed purpose, renewed secret request or inconsistent provider response. Keep the reason for closure beside its evidence owner.