> A correctly configured service should not attempt to access things is is not intended to access. If it has to check if it has access and act conditionally

It's normally recommended to attempt the access and handle the denial, instead of doing two separate steps (checking for access and doing the access); the later can lead to security issues (https://en.wikipedia.org/wiki/TOCTOU).

Yes, this is the explicit attempt of access which should be logged by the service.