Generally when you install an application, a list of permission is shown what thing that app can access in your phone. But do they show all the permissions? The app developer don't want you to know some things their app can access like an app can read your contents in SD card but what if it can also read your device ID and MAC Address, will this be written in the list of permissions specially when the developers intentionally want to hide this? Does google allow such apps on play store which hide some app permissions?
I've recently picked up Android development myself so I can tell you what I know.
Generally when an app needs access to features it has to declare it in
AndroidManifest.xml, or else the system throws exception when the app tries to access the feature. Also, even if the app declares permissions in detail (e.g. it wants to send/receive SMS), Android and Google Play will show the permission groups those permissions belong to (e.g. "phone calls and messaging", or something like that). In that sense when you look at the permission list displayed in Google Play or when installing you gain yourself a knowledge of the maximum this app is capable of doing.
There can be some exceptions, for example a feature not yet natively implemented in Android but by certain manufacturers, but as Android version grows later, these permissions should automatically get added to the apps requirement, even if the app does not explicitly state it. You still get the maximum knowledge.
If any veteran developer spot mistakes in what I said, please do point out, as I'm only a beginner in this field.
Android will prevent the app from accessing anything, which requires a permission not requested by the app.
That means if a permission is not displayed in the list, the app cannot access the information protected by it.