Least-Privilege Integration Design

Cloudflare's optional_scopes array moves the agent permission check to runtime

OAuth always allowed a token narrower than the request. What changes is that the client owner now declares which scopes a user may refuse, and the application has to read the token response to learn what it actually got.