Explanation/Reference:
* SharePoint users three types of authorization policies. The user-only policy requires only that the call to SharePoint include an authenticated user identity. The app-only policy requires only that the call include only an authenticated app identity. The user+app policy requires that the call include both kinds of authenticated identities.
* You may have already heard that OAuth 2.0 plays an important role in the authentication and authorization of apps for SharePoint. It does, but it is not necessarily a part of the authorization story for every app for SharePoint. If you plan to build an app for SharePoint that runs in an remote web application and communicates back to SharePoint using server-side code, you will need to use OAuth.
Scenario:
* The CourierMobile app must be able to connect to the SharePoint Customers list and verify whether the account belongs to the franchisee to avoid pickups or deliveries to customers that do not belongs to the franchisee. When the CourierMobile add accesses the Customers list, it must only read its contents with the minimum permissions necessary.
* Margie's Travel provides an API to enable external developers to authenticate by using OAuth and claims-based authentication. Many couriers are members of Margie's Travel Reference: Authorization and authentication of apps for SharePoint 2013