OAuth requests can match the task more closely
Less all-or-nothing consent
On 20 August 2026, Cloudflare added optional OAuth scopes. Users can decline selected optional permissions, and applications must check which scopes the resulting token actually received.
Design around minimum access
A scope describes an authorized capability, such as reading or modifying a resource. For an assistant reviewing configuration, separating reads from writes could provide a useful workflow at the first consent level. A later action could request additional access when it becomes necessary.
That changes interface design: available functions should match granted permissions, and errors should explain missing access clearly. A partially declined request becomes as important a test case as full authorization.
The token remains authoritative
A permission declared in the client does not prove it was granted. Service-side checks remain essential, especially for tools that can change infrastructure. This development improves consent precision but does not by itself define business rules or an autonomous agent’s boundaries.
Editorial retrospective: event dates are stated in the text.