Access control is not the same as logging - the first time an application tries to access the API the OS checks permissions, asks user to approve/deny, and then stores the user's choice. No need to log the actual API calls at all, no permanent records needs to be created.