Apparently we're currently letting users install Kiosk Apps (via chrome://extensions) without confirming permissions. This may have made some sense in the past where the app was completely isolated from user sessions so couldn't do much damage (although upon installation time it would still be beneficial for the device owner to see the capabilities of the apps they install).

Now that we're talking about adding extension APIs that potentially affect device-wide settings (such as networking), we must make sure that the device owner sees a permission prompt.