To capture all SQL you can use the Global LogActivity hook, which was added in 4.0.7 to allow logging and timing of all database activities (see LogActivity.doc). Parsing these SQL statements to determine the necessary object privileges requires some custom SQL analysis though.