Always log when granting/revoking capture sandbox extensions