Start with the question
Compare the request with the app’s stated purpose and provider privacy information. Do not assume all apps need the same access.
Put it into practice
Use your device’s supported permission controls. Ask the actual provider about a required request you cannot explain.