An OAuth scope is a named permission attached to an access token, such as read-only access to sessions. Scopes let an administrator give an agent exactly the access it needs and no more.
When an agent or integration signs in, it receives a token carrying a list of scopes. Every request is checked against that list.
AI agents act autonomously, so the question security teams ask first is what an agent is allowed to do. Scopes give a precise answer.
Each ResolveGrid MCP tool and API endpoint declares the scope it requires. An agent with a read-only token sees only read-only tools.