Scopes

Scope	Grants	Requirement
openid	The person’s sub. Always present, cannot be unchecked	—
profile	Their name	—
email	Their email, with email_verified: true — only ever a verified address	The person’s address must be verified
invoices:read	Read all their invoices, not only yours	—
invoices:write	Write invoices attributed to your verified brand	Verified domain
offline_access	A ninety-day refresh token	Confidential client only

Reading and writing are not a ladder

A shop writes and never reads. A tax accountant reads and never writes. Neither implies the other, and granting both to the same client is an explicit decision at registration.

Why writing requires a domain

invoices:write is tied to your brand: your name appears in the person’s expense list as a verified merchant, and the consent screen says “wants to record invoices in its name”. The only defence the reader has is that name, so the name has to mean something.

Without the check, anyone could sign up as “Amazon” and write invoices attributed to Amazon into the account of whoever consented.

Verification is checked when the client is created, not when it is used. A client that never received the permission cannot ask for it later.

What a third-party token never carries

No administrative permission, under any circumstances. Scopes map to SCOPE_* authorities and nothing else.