Ask when access is needed
Apps ask for access through a prompt from your device. You can allow, deny or sometimes limit access, and change your choice later in settings.
An app should ask when the reason is clear. For example, a scanning app can request camera access when you start a scan.
What happens if you say no
If you deny access, the app should explain what will not work and offer another way to continue where possible. It should also show how to change the permission later. Asking only for access the app needs helps protect your information. This is called least privilege.