Permission Scope

A keycard that only lights Floor 3 is not a cheaper card. That is the idea.

Permission scope is the written list of doors. repo:read is not repo:admin. An agent that can write in /tmp is not an agent with your SSH key. OAuth scopes, sandbox rules, and an MCP tool menu are the same list in different costumes.

A secret is the card. Scope is how many floors it lights. You can lock the card in a safe and still be in trouble, because it opens everything. Scope is what shrinks the blast if it walks out.

Smallest list that finishes the demo

The API window already decides the menu. Scope is a smaller menu for this caller: read orders, never delete customers. This product's tools are scoped on purpose — ds_plan_project, ds_create_project. They can stamp a stack. They cannot empty your GitHub. If "delete the repo" is not on the board, the model cannot order it.

Clicking "allow all" to dismiss a prompt is how Floor 3 becomes the vault. Ask: what is the smallest access that lets this actually work? You can widen later. You cannot un-leak a wide key.

Powerful and unscoped is the combination you never want. A confidently wrong agent with a read-only card can embarrass you. The same agent with delete-everything can ruin the week.

What this unlocks

Once the list is written down, trust moves out of the intern's personality and into the card. The key itself says no.

Don't light the whole building to unlock one floor.