OAuth scope
The specific permission an OAuth-authorized application is granted at a third-party service. Scopes determine what the application can read or write.
Why it matters
A well-scoped OAuth integration asks for the minimum permissions needed for the use case. A poorly-scoped one asks for everything. Users notice the difference at consent time ("this app wants to read all your email") and trust accordingly.
Scope choices have downstream consequences. Some providers (Google) gate certain scopes behind security review (CASA Tier 2, etc.). Asking for an over-permissive scope can mean weeks of compliance work; asking for the right minimum scope can mean shipping today.
How Ajeris handles this
Each connector requests the smallest scope that supports its features. Gmail uses gmail.send plus narrower read scopes (full inbox read is gated by Google's security review and deferred to Phase 2). Drive uses drive.file (only files the agent created), not full Drive access. Stripe uses Stripe Connect with explicit read and write capabilities per integration. The user sees the requested scope at consent time.
