Snaps are sandboxed. They can be granted extra privileges, such as access to $HOME, camera, bluetooth etc. Some of these interfaces such as $HOME can be gained automatically by any snap. Others need to be granted by Canonical (to automatically grant access on install), or manually granted by the user post install. There is also a 'classic' mode where the app is unsandboxed, which again needs to be granted by Canonical and in addition requires explicit acceptance by the user when being installed.