For safety reasons apps are seperated from the SharePoint where they are installed on. Apps are installed on other domains and that is how the seperation works. Apps can't contact the SharePoint, because Cross-Site-Scriptingis blocking it. But there is still a way to get data from the SharePoint and with this way comes a permission concept into the app world. Permissions There is a library, called the Cross Domain Library, that allows to communicate with a SharePoint from app site. This library is aviable on every SharePoint 2013 and is easy to call. But wait.. if it is so easy to call a library that can get SharePoint data it is not saver than before. This library contains more than communication.. it authentificates the app against the SharePoint and asks for permissions. This happens right after the installation of the app. The installing user will be asked to grand permissions for the app. But how does the app know what permissions are needed? Asking for permissions is you...