You should only request the permissions you need to operate your application. In fact, our analyses show a decline in the click-through rate if apps present more than three permissions at a time.
As a best practice, you should only request extended permissions at reasonable times when the user engages with features that would require their use. For example, if you are asking the user for the publish_actions permission in order to create a custom share UI, the user will better understand the context behind your request if presented with the permission while interacting with the app's share functionality.
