Audit notification access by tracing who can create an alert, who can change delivery rules, which devices can display it, and who can read its preview. Test representative accounts and devices with harmless messages. A notification toggle marked on is not proof that the alert arrives, remains private, or can be managed only by the intended person.
Map every control layer
Inventory the source application, user account, workspace or tenant policy, in-app subscriptions, operating-system permissions, per-app alert settings, Focus or Do Not Disturb, battery controls, lock-screen previews, browser site permissions, email and SMS fallback, wearable devices, vehicle displays, and mobile-device-management policy. Record owner, platform, version, and whether the user or administrator controls each layer.
Separate four questions: who may generate the notification, who may subscribe or unsubscribe, who may change delivery policy, and who may see message content. Include emergency alerts, security notices, approval requests, customer messages, mentions, marketing, and background status updates. Classify sensitive previews that could expose health, finance, personnel, location, or customer information.
Review Android behavior and permissions
Google's Pixel notification guidance documents per-app controls and notes that Do Not Disturb, Battery Saver, Adaptive Battery, lock-screen settings, and notification history can affect delivery or visibility. Record each relevant layer rather than repeatedly reinstalling the app. Test an immediate alert while the device is active, locked, idle, and in the approved quiet mode.
Keep notifications distinct from other application permissions. Google Play's Android permission guidance describes reviewing permissions per app or by permission type. Camera, contacts, location, microphone, and files can affect what a notification contains or what an app can do, but granting them is not a generic notification repair. Deny unnecessary access and document platform-specific behavior.
Review Apple behavior and privacy
Apple's iPhone notification settings guide describes per-app alerts, sounds, badges, previews, scheduled summaries, time-sensitive notifications, and visibility during screen sharing. It also notes that Focus can delay delivery. Check the intended Focus status, summary schedule, preview rule, and alert surfaces for each tested category.
Use invented content to inspect locked-screen and shared-screen exposure. Confirm that a hidden preview does not reveal the sender or subject where policy forbids it. If a managed profile controls settings, record the policy owner and do not override it on the device.
Test roles, devices, and failure cases
Build a matrix of notification type, sender role, recipient role, application setting, device setting, network state, expected delivery, preview expectation, and measured result. Test a normal message, urgent permitted message, muted channel, after-hours alert, revoked account, signed-out device, offline device reconnect, browser notification, email fallback, and wearable mirror where applicable.
Measure creation, server acceptance if visible, device receipt, user acknowledgement, and duplicate behavior separately. If an alert is late, isolate the application, operating system, battery policy, network, and connected-device layers one at a time. Do not disable device security, management, accessibility, or emergency safeguards to force a pass.
Audit administrative authority
List tenant owners, notification-policy administrators, mobile-device administrators, browser-policy owners, and people who can change emergency or organization-wide channels. Apply NIST's least-privilege principle: grant only the minimum access necessary for assigned work. Review generic accounts, former workers, automation tokens, and integration owners.
Record every mismatch with affected notification, observed behavior, expected behavior, privacy impact, owner, approved fix, and retest. The audit is complete when critical alerts reach the intended people, muted or restricted alerts remain suppressed, previews match privacy rules, managed policies have accountable owners, and representative allowed and denied changes behave as documented. Repeat after operating-system upgrades, new devices, app migrations, management-policy changes, and major workflow changes.
Sources
- Control notifications on your Pixel phone — Google Pixel Help
- Change app permissions on your Android phone — Google Play Help
- Change notification settings on iPhone — Apple Support
- Least privilege — National Institute of Standards and Technology