At first, Flatpak apps submitted to AppCenter may have precisely the same permissions as they do today: read and write access anywhere that you as a user have permission to access. This is because we are still controlling the automated testing, code review, human review, and curation just like we do with the unrestricted Debian-formatted apps today. So in the immediate future, nothing will visibly change and apps will behave identically.
In the future, we’ll be able to work with app developers to tighten up app permissions to ensure apps only have access to what they actually use and need. This will be a slow and methodical process as we ensure users don’t face regressions like no longer being able to use their external devices.