I am writing an application whose logic executes in the browser using JSOM. The application might have permissions that exceed that of those who access the application. Let's say the application simply adds List Items on their behalf, on lists to which they shouldn't have access. It's simple, for example the following creates a new list item that I can then add to some list:
var newItem = list.addItem(new SP.ListItemCreationInformation());
I believe this applies to all kinds of SharePoint apps, but I'm using SharePoint-hosted.