A read-only grant unexpectedly permits writes

An applicant asked only for read access but can use every scope allowed by the policy. Trace how a request captures its scopes and how authorization consumes them. Preserve least privilege without rejecting valid applications.

Work with the stack you want to practice. Your workspace and timer start after you choose.