The browser that takes without asking
Load a WebView and the page inherits the browser's full surface: it can read storage, call geolocation, open camera, and reach the network with little more than a prompt the user has learned to click through. There is no durable, per-program boundary — the same engine that renders your content also holds the keys. A malicious or careless page takes; the user finds out later.
A mini-program runtime inverts that default. Sensitive APIs are gated behind a scope the program must declare, the user must grant, and can later revoke. The program asks for what it needs, not everything at once.
What a scoped permission model is
The runtime exposes sensitive capabilities (location, camera, address book, payment) only through declared, named scopes. The user approves each scope at first use, and the grant is tied to that program, not the whole host. WeChat documents this with its scope authorization model; Apple's app guidelines and OWASP both treat scope and user consent as baseline mobile hygiene. The W3C Permissions specification codifies the same ask-then-access pattern for the open web.
Where the gap shows up
| Step | WebView (silent access) | Mini-program runtime (scoped) |
|---|---|---|
| API access | Inherited on load | Declared scope plus consent |
| User control | Click-through prompt | Grant per program, revocable |
| Blast radius | Whole engine | One program |
| Audit trail | Hard to trace | Declared scope list |
| Revocation | Clear app data | Revoke in settings |
The result is a boundary the WebView never had: a program can only do what the user explicitly allowed.
Why asking beats taking
A scoped, revocable model means a leaky or malicious program cannot silently exfiltrate the device's capabilities — the permission list is visible and the grant is removable. It also means the host app's own data stays outside the program's reach, because the program never received broad engine-level access.
How Cross Mini App applies it
Cross Mini App runs programs inside a runtime that gates every sensitive API behind a declared, user-consented scope, with revocation in the host settings. A program gets exactly the capabilities it asked for and nothing else. You stop inheriting the browser's keys and start granting access on purpose.
That is the difference between a page that takes the engine's power and a program that earns the user's trust.
