IME when logging in via Facebook, I can choose to not allow that site to have the ability to do certain things (like not post to my wall etc)

I also develop an application that uses Facebook login, and we (using django-social-auth) request one set of permissions initially, and request more later if the user wants to do advanced stuff.