Scopes & consent

Every grant is per-category. The consent page shows the user each scope you request as a plain-language checkbox — they can approve fewer than you asked for, and your app must degrade gracefully when they do.

Context scopes

Scope	User-facing label	Grants
`identity`	About you	Read the basics — name, bio.
`work`	Work	Read role and focus.
`projects`	Projects	Read current projects.
`preferences`	Preferences	Read how they like things done.
`relationships`	People & family	Read what they chose to share about their people.
`communication-style`	How you communicate	Read tone and style preferences.
`propose`	Propose learnings	Submit facts to the review queue. Never writes directly.

Likeness scopes

Scope	User-facing label	Grants
`likeness`	Likeness	List subjects (names, species, thumbnails) and request generated images. Never grants access to source photos.
`likeness:write`	Add subjects	Create subjects device-direct. User-initiated; audited.

Likeness scopes are off by default on the consent page. Request them explicitly in your OAuth scope parameter and tell the user in your own UI why you need them — "so your pets can star without uploads" converts better than a silent checkbox, and a user who skips the box will hit 403s you have to explain anyway.

Principles

Least privilege: request the minimum. A writing app has no business asking for likeness; a photo app may not need relationships.
Partial grants are normal: check granted_categories / expect 403s, and keep working with what you got.
Consent is per-app and revocable: the user sees your app, its scopes, and its last read on their connections page — and can end it in one click.
Every access is audited: reads, proposals, writes, and generations all appear in the user's log with your app's name.