When publishing Shopify or Bigcommerce Apps, I had to specify the read/write permissions I wanted for my app (eg. read products, read/write orders...). I am now developing a Magento Extension and wondering where and how I would specify my desired permissions. I took a look in the Connect Marketplace and when downloading extensions, there doesn't seem to be a step, where you agree to any permissions. Am I missing something?
There are not permissions at "extension" level in magento, regardless the installation source (connect, manual, etc).
You could set some ACL at backend level for menus and actions (view/save/edit)
And you can set some permissions for the SOAP an REST APIs throw configuration files.
I don't know exactly how Shopify works but based on my experience with this kind of SAAS product the permissions you set in your extension are very close to a manifest related to API features.