How can I tell which paths have been granted access by the user? I know that with NSOpenPanel, the sandbox is automatically expanded to allow access to the directory the user chooses. Is this information stored anywhere so I can know whether I need to throw up an NSOpenPanel or not?
Or do I need to track it locally in NSUserDefaults or something?
You are responsible to store already-granted paths using the Secure Bookmarks, read NSURL documentation.
If you need to access to a path check if you have it on secured bookmarks (stored for example inside NSUserDefaults) if you have reuse it otherwise show the open panel