Use the smallest scope set that supports the integration. Profile write is separate from profile read, organization context is separate from profile, and OIDC scopes are distinct from Lucion API scopes.
| Boundary | Do not assume |
|---|---|
| Scope | Does not grant a role or bypass organization policy. |
| API key | Does not create a browser session. |
| OAuth token | Does not authorize an organization the user cannot access. |
| Lyra delegation | Does not mean action execution is available. |