Scope
A named permission an OAuth client requests and a user consents to — the unit that limits what an access token actually authorizes.
Scopes are how OAuth keeps delegated access narrow: a client asks for exactly the permissions it needs, the consent screen shows the user exactly what’s being granted, and the resulting access token carries only those scopes. A resource server that skips checking the scope on a token — accepting any valid token for any action — quietly turns fine-grained consent into a rubber stamp.