It's an open protocol, nobody controls it so nobody gives permission to what you can build. Both in terms of apps/clients that make use of nostr, and also custom primitives to add into nostr. The protocol itself is permissionless.