Does ethereum.enable() prompt an Access signature every time it's called? Or will access-granted status persist?
It's up to the Web3 provider to decide. Metamask has (or will have, come Monday I believe) a "remember my choice" option that, when selected, will automatically give access to the given dapp next time. From the dapp's side, the ethereum.enable() promise will just resolve immediately instead of waiting.