App doesn't require access to all the permission it supports in the trust policy file

The list of available permissions to ask in a trust policy file is wider than the one requested by the installed app.

See for example security_events, which is not accessible by the app https://github.com/octo-sts/app/blob/bae5250f1daf30e647a13ab75c20863746ba3e6f/iac/sts_exchange.schema.json#L274