A scope is a named unit of access that a client can request, such as "read profile" or "read account balance." Scopes let an authorization request be as narrow as possible, a core part of the principle of least privilege, and they are the same mechanism agentic systems use to limit what an AI agent can do.
Frequently asked questions
Who decides what scopes are available for an application to request?
The authorization server (the identity provider) defines and registers the available scopes; the client requests a subset of them.
Can a customer see which scopes they're approving?
Yes, this is typically surfaced on the consent screen during the OAuth authorization flow.
How does this apply to AI agents?
The exact same mechanism, narrowed further; see scoped access for agents.
.avif)