As per the explanation here: https://github.com/TryGhost/Ghost/wiki/App-Ideas-Permissions#wiki-permissions

We want to make it possible for Apps to register for permissions in the same way that users have permissions. Those permissions are enforced in various places, most importantly in the API.

Apps need to make internal requests to the API methods via the proxy object.

Therefore we need a way to:

1. Determine or define which app is making the request.
   • This should probably be an extension of the apiContext (see ACL & the API: Current user everywhere #2058) as we still need to know on behalf of which user the request is being made.
2. Determine what permissions the app has.
   • This should probably be done by fetching those permissions from the correct app's config
3. Provide a way to ask if the current app and the current user have permission to perform the action they are trying to perform
   • This should likely be an extension of canThis, which takes a more complex context than a single user. `canThis({app: 'my-app', user: 1}).edit.post(2);

It's important to deal with permissions for both the app and the user, as otherwise in future it could be possible for a less privileged user to use an app to do things they shouldn't be able to.