Could you clarify permissions that are used by SharePoint App?
I see two cases:
- app works with host web
- app works with app web
There are three kinds of polices:
- User Only Policy
- App + User Policy
- App Only Policy
As I understand these polices is used to access to the host web. But what permissions is used to access app web? Does it use user only permissions? Can I create a list in the app web and send request with app only permissions?