As I understand there can be a "User+App" and "App" only policy permissions in SharePoint apps. The SharePoint hosted app cannot use the App-only policy. So here is the doubt I have. Suppose I have a SharePoint hosted app which has modify permissions on a list in the HOST web. The app adds new items/modifies items in the list. Now a user accessing the APP has READ permission on the list in host web. In this case both, the app and user identities will be sent during the add/modify operation.
So does this mean that the app wont be able to add/modify list items because the user has READ only permissions on the list ?
Also, can we say that the APP-only policy is something which can be used as Elevating privilages to perform operations that a user cannot perform ?