The command

With OnCue installed, paste this into Terminal. It asks macOS to print the permissions sealed into the copy on your disk.

codesign -d --entitlements - --xml /Applications/OnCue.app | plutil -p -

Executable=/Applications/OnCue.app/Contents/MacOS/OnCue
{
  "com.apple.security.app-sandbox" => true
  "com.apple.security.assets.movies.read-write" => true
  "com.apple.security.device.audio-input" => true
  "com.apple.security.device.camera" => true
  "com.apple.security.files.user-selected.read-write" => true
}

What each line means

app-sandbox puts OnCue in the App Sandbox. From then on the kernel allows what the rest of the list says and refuses everything else, whatever the app asks for.

assets.movies.read-write is your Movies folder, where recordings go unless you choose somewhere else. files.user-selected.read-write is the somewhere else: a folder you pick in a file dialog, and only that one.

device.camera and device.audio-input are the camera and the microphone. Even with these, macOS asks you the first time, and you can take either back in System Settings.

What isn't there

An app that opens a connection needs com.apple.security.network.client, and one that accepts connections needs network.server. OnCue has neither. Without them the sandbox refuses a connection before it starts, so there is no server for a recording to reach, no way to send a report, and no way for OnCue to check for its own updates. That isn't a promise about what the app chooses to do. It's a property of the file.

To see what the line looks like when it's present, run the same command on any other app in your Applications folder that uses the internet. Most print "com.apple.security.network.client" => true somewhere in the list.

Why the list can't lie

The entitlements are part of the code signature. Change one and the signature no longer matches, macOS refuses to open the app, and the App Store copy won't launch at all. So the list you print is the list I signed, and the signature says who that was:

codesign -dvv /Applications/OnCue.app

The copy from this site shows Developer ID Application: JACOB VANALSTYNE (DC3U4XZMM4). The App Store copy is signed by Apple on my behalf and carries the same five lines, plus two that Apple adds to every store app naming the app and the team.

The list says what OnCue is allowed to do. What it does with that is in the source, which is public under the MIT licence.

The output above is from OnCue 4.22. The list hasn't changed since 4.0, and a change to it would be in the changelog.