My $0.02:
It seems like solid-panes from the data browser don’t have to go through the system of app authorization. That system of whitelisting apps was put in to prevent apps from messing up each others data, even though they might be given permissions by the WebId using them. That system seems to go against the spirit of permission-less innovation. For example, when you first use an app you get a screen that is sort of like an ultimatum – either I can access everything on your pod – or not. I think this system of app permissions was kind of a stop gap measure until shapes could be used to limit changes to what is agreed to be interoperable with other apps, but it has a chilling effect. So the panes don’t have to go through that (afaict) but that makes the source of any pane code the subject of extra scrutiny, which is unfortunate.