maybe on-demand permission requests would be better for many of those things, like apple ios does when an app requests your location.
if i did something in google maps and it popped up a dialog asking for access to my call logs, i would certainly deny it, but i just did that update this morning and didn't even notice anything about it accessing my call logs.
Cancel doesn't give them APPLICATION NOW, so it's just training them to reflex-click allow. It's a pavlovian reaction: Cancel -> no application; Allow -> application. If they launched the application, they probably want to see what's in it.
