According to section 11.2 of the App Store Review Guidelines,
Apps utilizing a system other than the In App Purchase API (IAP)
to purchase content, functionality, or services in an app will be rejected.
Various apps like JetSetter, Gilt, and Kayak include in-app purchasing flows that either collect credit card information directly, or use a UIWebView to direct the user to a third-party website to purchase goods and services.
What provision allows apps to do this, and what are the limitations to purchasing physical goods and services in an iPhone app without using IAP?