# Permission Scope (/academy/permission-scope)



A keycard that only lights Floor 3 is not a cheaper card. That *is* the idea.

**Permission scope** is the written list of doors. `repo:read` is not `repo:admin`. An [agent](/academy/agent) that can write in `/tmp` is not an agent with your [SSH](/academy/ssh) key. [OAuth](/academy/oauth) scopes, [sandbox](/academy/sandbox) rules, and an [MCP](/academy/mcp) tool menu are the same list in different costumes.

A [secret](/academy/secret) is the card. Scope is how many floors it lights. You can lock the card in a safe and still be in trouble, because it opens everything. Scope is what shrinks the blast if it walks out.

**Smallest list that finishes the demo**

The [API](/academy/api) window already decides the menu. Scope is a smaller menu for *this* caller: read orders, never delete customers. This product's tools are scoped on purpose — `ds_plan_project`, `ds_create_project`. They can stamp a [stack](/academy/stack). They cannot empty your GitHub. If "delete the repo" is not on the board, the model cannot order it.

Clicking "allow all" to dismiss a prompt is how Floor 3 becomes the vault. Ask: what is the smallest access that lets this actually work? You can widen later. You cannot un-leak a wide key.

Powerful and unscoped is the combination you never want. A confidently wrong agent with a read-only card can embarrass you. The same agent with delete-everything can ruin the week.

**What this unlocks**

Once the list is written down, trust moves out of the intern's personality and into the card. The key itself says no.

Don't light the whole building to unlock one floor.