We've all gotten the popup dialog box that says "[Some App] wants to make changes, type your password to allow this", but is there a way to get more information about what those changes are? It's always from an app I "trust", but I'd still like to know more about what it's doing that it needs my password for. Seems an aweful lot like Windows Vista's uber-useful security popups.
You can use
sudo opensnoop -n ProcessName to see what files have been opened by a process, but only after they've been accessed of course. You could also use fseventer to display modified files in a tree view.
The dialogs are shown by installers because they need root permissions to modify /Applications/ or other folders that aren't owned by the user. You can press ⌘I to see what files would be copied by an installer.