Scopes

Scope	Grants
sources:read	read connected sources and quota
sources:write	connect, disconnect, configure sources; create Sweep Connect sessions
inventory:read	inventory, diagnosis, Digital State Graph
plans:write	create, validate, price plans; read executions and receipts
plans:commit	authorize and commit plans (within the user’s delegation)
vault:read	list, search, download Vault objects and manifests
vault:write	upload to the Vault; manage destinations
intel:read	trials, renewals, meters, spend map, Ask Sweep
creator:read / creator:write	creator revenue audit; connect sources, upload statements
usage:read	usage, charges, commercial envelope
grants:manage	list and revoke delegation grants
account:read	identity and events
webhooks:manage	webhooks

A scope never exceeds the end user’s delegation: a key with plans:commit acting through a connection whose grant lacks remove cannot commit a plan that trashes anything.