In it, Google explains that apps that target API level 23 will have to request permissions to access certain protected features. OEMs won't be able to avoid this, they will need to have dialogue windows for permission requests (ie the pop-ups) and a central location to manage all permissions (as in the Settings). These are non-negotiable (MUST) requirements.
More important however, is the fact that OEMs won't be able to (MUST NOT) grant permissions to pre-installed apps. There are two exceptions here. The first treats these like any other app, requiring them to ask for permissions before doing anything substantial. The second is when these apps are standard replacements for default ones, like the phone, camera, contacts app, etc.