Browser extension permissions are conceptually identical to mobile app permissions. Both software platforms have the ability to access very powerful APIs, but to protect the end user, permission to access these APIs must be explicitly requested on a piecewise basis. For both apps and extensions, permissions are declared by the developer in the code base – for extensions, this is the extension manifest. In both cases, requesting access to trivial permissions will not require explicit user permission, but very powerful permissions will require the user to explicitly grant access. Furthermore, adding additional permissions in a subsequent update will typically require the user to explicitly accept this change in scope.