A scope names a resource and the thing it covers: repo plus a collection, rpc, blob, account, identity; a namespace owner can bundle its record and service scopes into a permission set, published as a Lexicon; the user sees the list; resources are abstract, not endpoints.

Least privilege at the level of record types.

A scope says what an app may touch: a key labeled with one drawer. Repo, then a collection: this app may write recipes. Nothing else.

Other scopes cover calls to a service, uploading blobs, account details, and identity.

Whoever owns a schema namespace can bundle its record and service scopes into a permission set, published as a Lexicon. Named and owned, like any schema.

You see the list before you say yes.

Resources are described in the abstract, not tied to particular endpoints. The shape is fixed: name the thing, not the account.

Check yourself. What does repo:com.example.recipe allow?