Facebook gives the option to the users not to give some permissions. i.e. in theory an app is not allowed to require some extended permissions such as post on your timeline etc. Of course in practice I've seen apps that won't let you continue unless you give them all permissions they asked for - which is against the rules Facebook set in place.