Client, scope and user are three separate things
- Client: the named application connecting, registered and approved.
- Scope: the subset of the interface that client may call.
- User: the person the calls are made on behalf of, with their own permissions.
- Effective access: only what all three permit.
Why external agents stay consumers
An assistant connected through a scoped client sees a deliberately narrow surface. It cannot reach administrative functions simply because the person who connected it happens to be an administrator, because the client's scope never included them. That separation is what makes an external integration safe to grant and cheap to revoke.
Operational hygiene
- One client per integration, so revocation is surgical.
- Review connected clients on the same cadence as user access.
- Prefer short-lived tokens with refresh over long-lived secrets.
- Log which client performed each action, alongside the user.