"App <xxx> wants to access documents / network / blablah" kinda is.

I'm not saying controls on such behaviour are not useful. What is bad is dumping a truckload of popups on the user.