Permission scope

A named permission claim that authorizes a defined set of operations or resources under an access-control system.

An OAuth scope may cover one operation or a broad bundle, and its name may not reveal every resource or downstream capability. Providers can combine scopes with account roles, tenant policy, resource-level permissions, token audience, and application code. Consent screens may group scopes or require accepting the full requested set.

Builder example

Scopes decide the damage an agent can do if it misreads an instruction or follows a poisoned one. An assistant that only needs to summarize messages should request a read scope and nothing more, so a confused run cannot send or erase anything. When you connect an agent to an account, ask it which scopes the task genuinely requires and grant only those; if it asks for write access to do a read-only job, treat that as a reason to pause and narrow the request.

Common confusion: Granting a broad scope does not mean the agent will use all of it responsibly. A scope is a ceiling on what is possible, not a promise about what the agent intends, so a read-and-write grant leaves room for a misfired action that a read-only grant would have blocked outright.