you mean leaving it to the application to ask? In js?
Actually the overall entry point is a sync function call, you may refer to Zhang,xu's patch, the checkAccessControl from extension process to the runtime process is indeed sync.
But we still can respond to a sync IPC with some delays, like pop-up some dialog, or doing some time-consuming database operations or anything like that, so from the client side point of view, they won't know if there is a dialog or any user interaction was done before a 'allow' or 'deny' is returned to them. It's transparent by design.