Permission scope
- Standard term
A permission scope is a named level of access an app or assistant asks for on your account, such as reading your email or sending it.
When you approve, the provider gives the app a key, called an “access token,” that carries the scopes you agreed to. Every request the app makes is checked against them, so the limit holds whatever the app or its AI tries.
Where you’ll meet it
You connect an AI note-taker to your work calendar so it can join your meetings. The sign-in page says it wants to “see, edit, share, and permanently delete all the calendars you can access.”
What to do
Joining meetings only needs to see your calendar. Look on that page or in the note-taker's setup for a read-only option. If there isn't one, ask its support why it needs the rest, or pick another tool. To remove it later, look in your account's security settings.
Easy to mix up
The consent screen is the page that lists everything an app asks for. Each permission scope is one item on that list, such as reading your email or sending it.
Check yourself
Two email assistants do the same job. One asks for a single scope, “Manage your email.” The other asks for three: “Read your email,” “Edit labels,” and “See your contacts.” Which one can likely do less with your account?
Go deeperA scope sets the widest reach, and other settings narrow it
Scopes are part of OAuth (Open Authorization), the standard most large providers use when one app gets access to an account at another. Each provider defines its own scopes, and some consent pages make you accept the whole set or nothing.
The provider also checks the account's role, the organization's policies, and the sharing settings on each file, so a broad scope on a narrowly shared account still reaches little. When you build an agent, try an action its scopes exclude, using the agent's own token, to confirm that limit holds, and prefer tokens that expire quickly.