Generally, an app requests permission at runtime when it’s attempting to access sensitive data, like a user’s location, contacts, calendar, microphone, or storage. These permissions have to be explicitly granted by the user at that moment, and not just when the app is installed. See below for an example.
We know that to best protect your organizations and better serve your employees, you need increased control over the applications running on their mobile devices. With this launch, we’re doing just that. Going forward, G Suite admins can manage permissions that Android apps request at runtime, as opposed to at installation time (also known as “runtime permissions”). Note that this feature is only available for apps running in work profiles or on company-owned devices.