1# Workflow for Requesting Permissions
2
3You need to determine whether your application needs related permissions before accessing data or performing an operation. If permissions are required, you must request the permissions in the application installation package.
4
5Different permissions have different Ability Privilege Levels (APLs), authorization modes, and requesting methods. The workflow in the following figure helps you determine whether your application needs to request a permission.
6
7![](figures/workflow_for_using_permissions.png)
8
9**NOTE**
10
11- ① For details about the mappings between application APLs and permission APLs, see [APL](app-permission-mgmt-overview.md#basic-concepts-in-the-permission-mechanism).
12
13- ② Permissions can be classified into system_grant permissions and user_grant permissions based on the authorization mode. For details, see [Authorization Mode](app-permission-mgmt-overview.md#authorization-mode).
14  - A system_grant permission is pre-granted when the application is installed.
15  - For a user_grant permission, apply for the permission as follows:
16     1. In the configuration file, declare the permissions required by your application.
17     2. Associate the object that requires the permission in the application with the permission. This allows the users to know what operations need user authorization.
18     3. When the application in running needs to access the target object, an API will be called to trigger a dialog box for requesting user authorization. This API first checks whether the user has granted the permission required. If no, a dialog box will be displayed to request authorization from the user.
19     4. Check the user authorization result. Allow subsequent operations only after the user has granted the permission to the application successfully.
20
21- ③ You can use the access control list (ACL) to allow an application to have a higher-level permission. For details, see <!--RP1-->[ACL](app-permission-mgmt-overview.md#basic-concepts-in-the-permission-mechanism).<!--RP1End-->
22
23The operation for requesting a permission varies, depending on the permission APL and authorization mode.
24
25## Requesting Permissions for <!--Del-->normal <!--DelEnd-->Applications
26
27| Permission Type| Authorization Mode| Operation Path|
28| -------- | -------- | -------- |
29| [Open system_grant permissions](permissions-for-all.md)| system_grant | [Declare permission](declare-permissions.md) &gt; Access API|
30| [Open user_grant permissions](permissions-for-all-user.md)| user_grant  | [Declare permission](declare-permissions.md) &gt; [Request user authorization](request-user-authorization.md) &gt; Access API|
31| <!--DelRow-->[system_grant permissions available for normal applications via ACL](permissions-for-system-apps.md#system_grant-permissions-requestable-via-acl)| system_grant | [Request restricted permission](declare-permissions-in-acl.md) &gt; [Declare permission](declare-permissions.md) > Access API|
32| <!--DelRow-->[user_grant permissions available for normal applications via ACL](permissions-for-system-apps.md#user_grant-permissions-requestable-via-acl)| user_grant | [Request restricted permission](declare-permissions-in-acl.md) &gt; [Declare permission](declare-permissions.md) > [Request user authorization](request-user-authorization.md) > Access API|
33<!--RP2--><!--RP2End-->
34
35<!--Del-->
36> **NOTE**
37>
38> - A normal application cannot request a system_basic permission whose **Enable via ACL** is **false**.
39> - You can use DevEco Studio to request a permission via the ACL. However, this method applies to the applications in debug phase, but not to the applications to be released to the app market. For a commercial application, apply for a release certificate and profile in the app market.
40
41## Requesting Permissions for system_basic Applications
42
43| Permission APL| Authorization Mode| Enable via ACL| Operation Path|
44| -------- | -------- | -------- | -------- |
45| normal or system_basic| system_grant | - | [Declare permission](declare-permissions.md) &gt; Access API|
46| normal or system_basic| user_grant | - | [Declare permission](declare-permissions.md) &gt; [Request user authorization](request-user-authorization.md) &gt; Access API|
47| system_core | system_grant | true | [Request restricted permission](declare-permissions-in-acl.md) &gt; [Declare permission](declare-permissions.md) > Access API|
48| system_core | user_grant | true | [Request restricted permission](declare-permissions-in-acl.md) &gt; [Declare permission](declare-permissions.md) > [Request user authorization](request-user-authorization.md) > Access API|
49
50To change the application APL to system_basic or system_core, modify the HarmonyAppProvision file (**Toolchains / _{Version} _/ lib / UnsgnedReleasedProfileTemplate.json** file in the SDK directory) of the application when developing the application installation package, and sign the application again.
51
52**Example**
53
54Modify the **"bundle-info"** &gt; **"apl"** field in the file.
55
56```json
57"bundle-info" : {
58    // ...
59    "apl": "system_basic",
60    // ...
61},
62```
63
64> **NOTE**
65>
66> Modifying the HarmonyAppProvision configuration file applies to the applications in the debug phase, but not to the applications released to the app market. For a commercial application, apply for a release certificate and profile in the app market.
67
68<!--DelEnd-->
69